Skip to main content

Linux Imaging And Printing EUVDEUVD-2026-31194

| CVE-2026-8632 HIGH
Command Injection (CWE-77)
2026-05-20 hp-security-alert@hp.com GHSA-w45w-c9pr-p65f
RCE Command Injection HP Linux Imaging And Printing
8.5
CVSS 4.0 · Vendor: hp
View

Vulnerability Assessment

Weakness
CWE
CWE-77
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Local privilege escalation in HP Linux Imaging and Printing Software (HPLIP) allows authenticated low-privileged users to execute arbitrary OS commands via command injection, potentially gaining elevated privileges on affected Linux hosts. The CVSS 4.0 score of 8.5 reflects high impact to confidentiality, integrity, and availability with low attack complexity, and no public exploit identified at time of analysis. The vulnerability is reported directly by HP PSIRT under advisory hpsbpi04118.

Affected VersionsENISA

HP Linux Imaging and Printing Software 0 <3.26.4

Affected Packages

euvd hp_linux_imaging_and_printing_software fix: 3.26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Linux Imaging And Printing gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hp) PRIMARY 8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
May 20, 2026 - 22:02 EUVD

DescriptionCVE.org

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.

Executive ViewAI

Why It Matters

HP Linux Imaging and Printing Software (HPLIP) contains a local privilege escalation vulnerability (CVE-2026-8632, CVSS 8.5) exploitable by authenticated low-privileged users to execute arbitrary commands and gain administrative access on affected Linux systems. This threatens confidentiality, integrity, and availability of enterprise infrastructure; any user account-including service accounts and contractors-can escalate privileges. Organizations with distributed printing environments or multi-tenant Linux infrastructure face immediate risk to operational security.

Recommended Action

24 hours: Enumerate all systems running HPLIP and classify by user access patterns (single-admin vs. multi-user); restrict new unprivileged account creation on affected systems and audit existing user privileges. 7 days: Deploy SELinux or AppArmor profiles limiting HPLIP process capabilities; disable HPLIP on non-production and single-function systems; enable auditd/EDR monitoring for privilege escalation attempts. 30 days: Monitor HP PSIRT advisory hpsbpi04118 for patch release; evaluate alternative print management solutions (CUPS hardening, dedicated print servers); conduct security testing on mitigations before production deployment.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable HPLIP where imaging functionality is not operationally required; (2) Enforce mandatory SELinux/AppArmor policies restricting HPLIP process capabilities and command execution; (3) Implement application whitelisting to prevent command injection execution; (4) Restrict local login access and SSH key distribution to systems running HPLIP; (5) Deploy real-time privilege escalation monitoring via auditd with alerting for setuid/sudo execution from HPLIP processes; (6) Isolate affected systems on network segments with restricted lateral movement; (7) Apply principle of least privilege to user accounts with HPLIP access.

Threat Intelligence Overview

EPSS Score
0.1%
Top 83% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Linux Imaging And Printing

View all
CVE-2026-8631 CRITICAL
9.3 May 20

Heap-based integer overflow in the hpcups component of HP Linux Imaging and Printing Software (HPLIP) allows attackers t
CVE-2015-0839 HIGH
8.1 Aug 02

The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execut

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8632 ADVISORY https://ubuntu.com/security/notices/USN-8483-1 ADVISORY https://vuldb.com/vuln/364959 REF https://access.redhat.com/errata/RHSA-2026:26228 REF https://access.redhat.com/errata/RHSA-2026:26297 REF https://access.redhat.com/errata/RHSA-2026:26335 REF https://access.redhat.com/errata/RHSA-2026:48171 REF https://access.redhat.com/errata/RHSA-2026:48586 REF https://access.redhat.com/errata/RHSA-2026:48603 REF https://access.redhat.com/errata/RHSA-2026:48606 REF https://access.redhat.com/errata/RHSA-2026:48959 REF https://access.redhat.com/errata/RHSA-2026:48960 REF https://access.redhat.com/errata/RHSA-2026:48961 REF https://access.redhat.com/security/cve/CVE-2026-8632 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480297 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8632.json REF https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy