HP Support Assistant EUVD-2026-70656

Exploitation requires a local, authenticated user account with low privileges on an HP system running HP Support Assistant versions prior to 9.53.2.0. The CVSS 4.0 AT:P (Attack Requirements: Present) metric indicates that specific conditions beyond the attacker's direct control must exist on the target - the exact nature of these conditions (e.g., a running service state, specific file system configuration, or accessible IPC endpoint) is not further detailed in available data and should be verified from the HP advisory. No user interaction is required once the conditions are met. Exploitation is limited to local access only (AV:L); remote unauthenticated exploitation is not possible. No exploitation via network vector has been identified.

The CVSS 4.0 score of 7.3 with vector AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N indicates a local, low-complexity attack requiring low privileges but dependent on specific conditions (AT:P). Full confidentiality, integrity, and availability impact on the vulnerable system is assessed, which is consistent with a successful privilege escalation to SYSTEM. There is no scope change to subsequent systems. No EPSS data is available, no CISA KEV listing exists, and no public exploit code has been identified - these signals collectively suggest this is not under active broad exploitation. The realistic risk is therefore limited to insider threat and post-initial-access lateral/vertical movement scenarios rather than opportunistic remote attack chains. The AT:P condition moderately constrains exploitation and should be clarified by HP's advisory for precise defender guidance. Overall, this is a genuine but contained local privilege escalation warranting prompt patching on HP endpoints, particularly in enterprise environments where HP hardware is common.

An attacker with a low-privileged local user account on an HP system running HP Support Assistant prior to 9.53.2.0 identifies an overly permissive access control boundary in the application - such as an exposed named pipe, COM interface, or file path writable by standard users but consumed by a privileged HP Support Assistant service. The attacker triggers the privileged code path through the insufficiently guarded interface, causing execution in the context of the elevated service. No public exploit code has been identified; successful exploitation depends on the specific AT:P condition being present on the target system.