Search/CVE-2026-1997
● CVE — Medium

CVE-2026-1997

VendorhpProductd9l63a firmware, d9l64a firmware, j3p65a firmware, j3p68a firmware, t0g70a firmware, d9l20a firmware, d9l21a firmware, g5j38a firmware, g5j56a firmware, j3p66a firmware, j3p67a firmware, j6x83a firmware, k7s32a firmware, k7s39a firmware, k7s40a firmware, k7s41a firmware, k7s42a firmware, k7s43a firmware, l3t99a firmware, m9l65a firmware, t0g56a firmware, t0g65a firmware, t1p99a firmware, y0s18a firmware, y0s19a firmwareDiscoveredFeb 10, 2026UpdatedFeb 12, 2026

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

View graph Watch Export
CVSS v3.1
5.3 MEDIUM
EPSS
0.22%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.03pp
0.20% → 0.22% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityLOW
IntegrityNONE
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Connections
26 relationships
Timeline
disclosure → media coverage
Feb 10, 2026
Disclosure — published as a CVE record.