HP Web Jetadmin EUVD-2026-60324

No authentication is required - the CVSS 4.0 vector specifies PR:N and UI:N, confirming unauthenticated exploitation over the network with no user interaction. The attack complexity is low (AC:L) with no specific attack requirements (AT:N), meaning default WJA deployments reachable over the network are susceptible. The primary limiting factor is network reachability: organizations that restrict WJA management interface access to internal management VLANs or specific IP allowlists significantly reduce exposure. WJA is a Windows-hosted application, so exploitation is limited to Windows hosts running WJA. The DLL hijacking pathway may require specific WJA features or services to be active; however, no configuration-specific prerequisite was described in the advisory data - all running WJA instances should be treated as exposed until HP clarifies scope.

The CVSS 4.0 base score of 8.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects a severe, low-complexity, unauthenticated network-exploitable flaw with full triad impact - this is a genuinely high-priority finding, not a high-score-but-low-risk anomaly. The E:P (Proof of Concept) supplemental metric elevates urgency further, indicating exploit code is publicly available, reducing attacker barrier to entry. KEV status is not confirmed, so 'confirmed actively exploited' cannot be asserted; however, POC availability for an unauthenticated network file read/write against a printer management server is operationally dangerous. EPSS data was not provided in the input - real-world exploitation probability from that signal is unknown. A notable data quality concern: CWE-787 (Out-of-Bounds Write) is inconsistent with a DLL hijacking description; defenders should verify root cause with HP's advisory to ensure mitigation targets the correct attack surface. The all-version CPE wildcard (cpe:2.3:a:hp_inc.:web_jetadmin:*) implies no version is confirmed safe without patching.

A remote unauthenticated attacker sends a crafted network request to the HP Web Jetadmin web interface that triggers a vulnerable DLL-loading code path, allowing substitution of a malicious DLL into the application's search path. Through this mechanism the attacker reads sensitive files - such as WJA configuration files containing device credentials - or writes files to arbitrary paths on the WJA Windows host, potentially dropping a malicious executable for later execution. Because proof-of-concept code exists publicly (CVSS 4.0 E:P), this scenario requires minimal attacker sophistication once network access to the WJA port is established.