Do Son 
HP released urgent security updates on September 16, 2026, to patch critical HP Advance vulnerabilities. These software flaws allow unauthenticated attackers to execute arbitrary code or overwrite files on affected servers. Therefore, administrators must apply the latest software versions to secure their enterprise printing environments.
- Product: HP Inc HP AC Print & Scan
- Vulnerabilities: 3 flaws (CVE-2026-89082, CVE-2026-89083, CVE-2026-89084)
- Highest severity: 9.3 (Critical · CVSSv4)
- Worst impact: HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
- Status: No confirmed exploitation yet; patches available
- Action: Update to <V1R4.0.027, <V1R4.0.029 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-89082 | 9.3 | HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write | <V1R4.0.027, <V1R4.0.029 | Not exploited |
| CVE-2026-89083 | 9.3 | HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write | <V1R4.0.027, <V1R4.0.029 | Not exploited |
| CVE-2026-89084 | 8.8 | HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write | <V1R4.0.027, <V1R4.0.029 | Not exploited |
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy This Threat Matters
Industry estimates indicate that thousands of corporate environments deploy HP Advance software. This platform manages centralized printing and scanning tasks for large networks. If threat actors exploit these security weaknesses, they can hijack the server hosting the application. Consequently, attackers can pivot into sensitive network segments. They can also compromise confidential business documents stored on the print server.
How the Attack Works
The HP Advance vulnerabilities stem from improper input validation within the software components. First, a network-based attacker sends crafted requests to the vulnerable HP Advance server. Due to inadequate data sanitization, the application processes these malicious payloads incorrectly. This failure allows the attacker to execute unauthorized operating system commands. Furthermore, the attacker can perform arbitrary file writes.
The vendor states, “HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software.”
The most severe bug, CVE-2026-89082, carries a CVSS 4.0 base score of 9.3. Similarly, another critical flaw, CVE-2026-89083, shares the exact same severity rating. A third flaw, CVE-2026-89084, poses a high risk with an 8.8 rating. Currently, security researchers have not confirmed any in-the-wild exploitation. Likewise, no public proof-of-concept exploit code exists.
Affected Versions
These software defects impact the HP Advance server hosting the software. Specifically, vulnerable products include HP AC Print & Scan running versions prior to V1R4.0.027. Additionally, HP Output Central versions older than V1R4.0.029 contain these security defects.
Patch and Mitigation Steps
HP strongly urges organizations to apply the official software updates. To resolve the issue, system administrators must upgrade HP AC Print & Scan to version V1R4.0.027 or later. They must also update HP Output Central to version V1R4.0.029. Administrators can find complete remediation instructions in the official HP security advisory. At this time, the vendor has not provided any temporary mitigation measures. Therefore, immediate software patching remains the only verified defense.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
