12
CVEs
0
Critical
9
High
0
KEV
0
PoC
1
Unpatched C/H
91.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
9
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Intelligent Management Center
196
Debian Linux
75
Java
74
Ubuntu Linux
74
Enterprise Linux Desktop
71
Enterprise Linux Workstation
71
Enterprise Linux Server
70
Jdk
59
Jre
58
Instantos
56
Arubaos
54
Xp7 Command View
53
System Management Homepage
48
Enterprise Linux Server Aus
48
Satellite
45
Enterprise Linux Server Tus
44
Enterprise Linux Server Eus
42
Systems Insight Manager
31
Opensuse
28
Struxureware Data Center Expert
26
Jrockit
26
Storage Data Protector
24
Enterprise Linux Eus
23
Leap
21
Loadrunner
20
Arcsight Logger
19
Matrix Operating Environment
19
Service Manager
19
Oneview
19
Hp Ux
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-12553 | Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis. | HIGH | 8.9 | 0.3% | 45 |
|
| CVE-2026-12554 | Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-81012 | Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-12855 | Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2026-12555 | Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-12556 | HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-15431 | Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue. | HIGH | 7.3 | 0.1% | 37 |
|
| CVE-2026-81011 | Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%). | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-82346 | Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. | HIGH | 7.0 | 0.1% | 35 |
|
| CVE-2026-17639 | Uncontrolled resource consumption in HP Smart Tank All-in-One printers allows unauthenticated network attackers to render affected devices unavailable by flooding them with concurrent HTTP requests. The vulnerability (CWE-400) is rooted in the printer's embedded HTTP service failing to throttle or bound incoming connection load, causing availability loss without any authentication requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, though the simplicity of the attack vector (parallel HTTP flooding) significantly lowers the skill bar for exploitation. | MEDIUM | 6.9 | 0.3% | 35 |
|
| CVE-2026-81013 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_pas | – | 0.2% | – |
|
|
| CVE-2026-81014 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_sto | – | 0.2% | – |
|