HP Easy Start EUVD-2026-64950

Exploitation requires the target macOS system to be running HP Easy Start prior to version 2.16.7.260722, combined with three specific prerequisites. First, the attacker must hold low-privilege authenticated access (PR:L per CVSS 4.0) - fully unauthenticated remote exploitation from an arbitrary network origin is not indicated by the available data. Second, the attacker must achieve network positioning sufficient to intercept cleartext traffic (AT:P per CVSS 4.0), such as through ARP spoofing, a rogue wireless access point, or control of a network device on the same segment. Third, the application must be performing a workflow that triggers the cleartext transmission of sensitive data, meaning timing or triggering of a setup or authentication event may be required. Exploitation is limited to macOS; no other platforms are identified. These combined prerequisites make opportunistic mass exploitation unlikely, with insider threat or compromised network infrastructure being the more credible attack paths.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L) indicates a network-reachable flaw that requires low-privilege authentication and specific attack prerequisites, meaningfully tempering exploitability compared to a fully unauthenticated, no-condition attack. The AT:P modifier implies the attacker must achieve favorable network positioning - such as a man-in-the-middle vantage point - before the cleartext interception becomes viable, adding a practical barrier beyond the raw score. The High ratings across VC/VI/VA indicate that a successful compromise could result in complete loss of confidentiality, integrity, and availability on the vulnerable macOS system, which is a serious outcome. EPSS data was not provided in the available intelligence, making probabilistic exploitation likelihood impossible to quantify from this dataset. The vulnerability is not listed in CISA KEV, confirming that active exploitation has not been officially reported, and no public proof-of-concept exploit has been identified. Given HP Easy Start's narrow deployment footprint as a printer setup utility and the prerequisite network positioning requirement, practical organizational risk is moderate despite the high CVSS impact metrics - the threat is most relevant in flat or poorly segmented office networks where an insider or compromised endpoint could achieve the necessary position.

An attacker with low-privilege access on the same network segment as a macOS workstation running HP Easy Start prior to 2.16.7.260722 performs ARP spoofing or operates a rogue access point to achieve a man-in-the-middle position, then waits for or triggers a printer setup or update workflow that causes the application to transmit sensitive data in cleartext. The attacker captures the credentials or authorization tokens from the intercepted traffic and replays them to authenticate as a higher-privileged user or process on the affected macOS system, achieving privilege escalation. No public proof-of-concept has been identified at time of analysis.