27
CVEs
2
Critical
17
High
0
KEV
0
PoC
4
Unpatched C/H
74.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
17
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (30)
Intelligent Management Center
196
Debian Linux
75
Java
74
Ubuntu Linux
74
Enterprise Linux Desktop
71
Enterprise Linux Workstation
71
Enterprise Linux Server
70
Jdk
59
Jre
58
Instantos
56
Arubaos
54
Xp7 Command View
53
System Management Homepage
48
Enterprise Linux Server Aus
48
Satellite
45
Enterprise Linux Server Tus
44
Enterprise Linux Server Eus
42
Systems Insight Manager
31
Opensuse
28
Struxureware Data Center Expert
26
Jrockit
26
Storage Data Protector
24
Enterprise Linux Eus
23
Leap
21
Loadrunner
20
Arcsight Logger
19
Matrix Operating Environment
19
Service Manager
19
Oneview
19
Hp Ux
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-14544 | Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter across Red Hat Enterprise Linux 6 through 10, where an integer overflow triggered by specially crafted print data can corrupt memory. This is an incomplete-fix follow-up to CVE-2026-8631, meaning the original patch did not fully close the flaw, and no public exploit has been identified at time of analysis. The Red Hat CVSS of 9.8 reflects a network-reachable, unauthenticated attack path, though realistic exploitation depends on how the CUPS print pipeline is exposed. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-8631 | Heap-based integer overflow in the hpcups component of HP Linux Imaging and Printing Software (HPLIP) allows attackers to achieve arbitrary code execution and/or privilege escalation by submitting crafted print data. The CVSS 4.0 base score of 9.3 reflects network-reachable exploitation against the printing subsystem with no authentication or user interaction required, though no public exploit identified at time of analysis and the issue has not been added to CISA KEV. | CRITICAL | 9.3 | 0.0% | 47 |
|
| CVE-2026-12553 | Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis. | HIGH | 8.9 | 0.3% | 45 |
|
| CVE-2026-4682 | Remote code execution in HP DeskJet All-in-One printers via malformed WSD scan requests allows adjacent network attackers to fully compromise the device. A stack-based buffer overflow (CWE-121) in the MFP's processing of Web Services for Devices (WSD) scan jobs enables unauthenticated arbitrary code execution. No active exploitation or public proof-of-concept has been reported, and EPSS predicts low exploitation likelihood. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-12554 | Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-5064 | Local privilege escalation and denial of service in HP One Agent software on HP PC products allow authenticated low-privileged users to gain elevated rights or disrupt the agent. HP has acknowledged the issue and is releasing software updates as mitigation. No public exploit identified at time of analysis, and the flaw is not listed on CISA KEV. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-8632 | Local privilege escalation in HP Linux Imaging and Printing Software (HPLIP) allows authenticated low-privileged users to execute arbitrary OS commands via command injection, potentially gaining elevated privileges on affected Linux hosts. The CVSS 4.0 score of 8.5 reflects high impact to confidentiality, integrity, and availability with low attack complexity, and no public exploit identified at time of analysis. The vulnerability is reported directly by HP PSIRT under advisory hpsbpi04118. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-81012 | Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-2891 | Denial of service in HP Poly Voice IP endpoints (CCX, Trio C60, and Edge E series) allows an attacker operating or impersonating a SIP server to render affected devices inoperable by returning malformed data during SIP signaling. The flaw is an uncontrolled-resource-consumption / improper-input-handling issue (CWE-400) that crashes or hangs the phone, disrupting voice service. HP has published advisory hpsbpy04096 and is releasing firmware updates; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-12855 | Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2026-12555 | Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-12556 | HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-13753 | Information disclosure in HP Deskjet 2800 Series printers running firmware TBP1CN2612AR or earlier lets an unauthenticated attacker on the network read sensitive configuration - including plaintext Wi‑Fi Direct credentials, device identity, and administrative security state - by sending plain GET requests to administrative API endpoints. The same data is gated behind administrator login in the web UI, so these API endpoints bypass the product's own access-control model. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-8864 | Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided. | HIGH | 7.3 | 0.1% | 37 |
|
| CVE-2026-7539 | Local privilege escalation and arbitrary code execution in the HP Accessory WMI Provider installer bundled with certain HP Docking Stations allows a low-privileged local user to gain elevated (likely SYSTEM) execution. The root cause is insecure temporary-file/directory permissions used during installation (CWE-379), which an attacker can abuse to introduce or replace executable content that a privileged installer process runs. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; HP has published advisory hpsbhf04129 and is releasing software updates. | HIGH | 7.3 | 0.1% | 37 |
|