Which versions of HP Fan Control App are affected by CVE-2026-8864?

HP Fan Control App contains a local privilege escalation vulnerability (CVE-2026-8864) that allows low-privileged local users to gain full administrator access on affected HP endpoints.. A patch is available.

How to fix or mitigate CVE-2026-8864?

24 hours: Conduct asset inventory to identify all HP endpoints with Fan Control App installed and map local user access levels. 7 days: Apply compensating controls (see below); restrict service execution and file permissions; document endpoints where Fan Control cannot be disabled due to operational requirements. 30 days: Monitor HP Security Advisory channels for patch release; establish deployment plan to apply patch immediately upon release; evaluate alternative fan control solutions if vendor patch is not released within 90 days.

HP Fan Control App CVE-2026-8864

Q: What is the CVSS score of CVE-2026-8864?

CVE-2026-8864 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40368 HIGH

Unquoted Search Path or Element (CWE-428)

2026-06-30 hp

GHSA-p9w6-48xr-5r6q

Privilege Escalation HP Hp Fan Control App Hp Inc

7.3

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local low-privileged attacker (AV:L/PR:L); the writable-path/timing precondition maps to AC:H; success yields full SYSTEM control, so C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 18:01 EUVD

Analysis Generated

Jun 30, 2026 - 17:20 vuln.today

DescriptionCVE.org

The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vulnerability.

AnalysisAI

Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The HP Fan Control App is an HP-supplied thermal/fan management utility (CPE cpe:2.3:a:hp_inc.:hp_fan_control_app) that runs with elevated privileges to read sensors and adjust fan speeds. The root cause is CWE-428, Unquoted Search Path or Element - a privileged Windows service or helper either references its binary via an unquoted path containing spaces, or loads a supporting executable/DLL from a directory writable by standard users. Windows then resolves the ambiguous path or search order to an attacker-planted file, executing it in the security context of the privileged process. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L) confirms local-only access, low complexity, an additional attack requirement (AT:P, e.g. a writable directory or a specific service-restart/login event), and that the attacker already holds low privileges.

RemediationAI

Apply the updated HP Fan Control App that HP has released to mitigate this issue; the exact fixed version is not stated in the provided data, so consult HP advisory HPSBHF04122 at https://support.hp.com/us-en/document/ish_15217742-15217770-16/hpsbhf04122 for the precise patched version and obtain it through HP Support Assistant or the HP software download portal. Patch available per vendor advisory. Until the update is deployed, reduce exposure by restricting which users can log in interactively to affected hosts and by auditing and tightening NTFS permissions on the app's install and working directories so that standard users cannot write executables or DLLs into the privileged process's search path (this directly defeats the CWE-428 condition but should be validated against HP's expected directory layout to avoid breaking the utility); on devices where fan control is not essential, uninstalling or disabling the app removes the attack surface at the cost of losing thermal customization. These are compensating controls only - the vendor update is the definitive fix.