EUVD-2026-81089
GHSA-hq92-gr4h-4mr3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauth network code injection to RCE justifies PR:N and C/I/A:H, but the vendor's 'under certain conditions' qualifier implies a configuration/feature prerequisite, so AC:H rather than the vendor's AC:L.
Primary rating from Vendor (hp).
CVSS VectorVendor: hp
Lifecycle Timeline
2DescriptionCVE.org
HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software.
AnalysisAI
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the HP Advance server hosting the software (HP AC Print & Scan and/or HP Output Central print-management components) and, per the vector, requires only network reach with no authentication and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a worst-case network, unauthenticated, no-interaction code-injection (CWE-94) flaw yielding full compromise of the HP Advance server - which on its face warrants urgent prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the security update provided by HP in advisory hpsbpi04149 for HP Advance, which should address the code injection flaw; no specific fix version is listed in available data, so consult the advisory for the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HP Advance server instances and specifically the HP AC Print & Scan and HP Output Central components, then restrict network access to these systems to only trusted users and networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hp Ac Print Scan
View allUnauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-managemen
HP Advance server software contains a path traversal vulnerability (CWE-22) in its HP AC Print & Scan and HP Output Cent
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today