Loading story…
Researchers disclosed a high-impact vulnerability chain in OpenPrinting CUPS affecting version 2.4.16 and earlier that can let an unauthenticated remote attacker progress from network-reachable print-job submission to code execution as lp and then to a root-level file overwrite. The chain combines CVE-2026-34980, which abuses anonymous Print-Job requests against a shared PostScript queue, with CVE-2026-34990, an authorization flaw that lets a local unprivileged user coerce cupsd into authenticating to an attacker-controlled localhost IPP service and reuse a print admin token to overwrite root-owned files. Public advisories and proof-of-concept details were released by researcher Asim Viladi Oglu Manizada and OpenPrinting, and fixes were committed publicly even though no patched release was yet available.
Defenders were urged to reduce exposure immediately because exploitation depends on reachable cupsd services, legacy shared queues, and permissive submission behavior rather than user interaction. Recommended mitigations include disabling or restricting network exposure of CUPS, requiring authentication for shared queue submissions, disabling shared legacy queues where possible, and confining the service with SELinux or AppArmor. Follow-on discussion noted that removing CUPS outright may be impractical on some Ubuntu systems because cupsd is commonly installed by default and intertwined with other packages, making service isolation and firewalling more realistic short-term controls.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Follow-up discussion on oss-sec noted that removing CUPS on Ubuntu can be impractical because it is installed by default and may be re-enabled or reinstalled; another reply clarified that the vulnerable component is cupsd rather than libcups and suggested daemon management or firewall isolation.
The Canadian Centre for Cyber Security issued advisory AV26-326, urging administrators to review the OpenPrinting advisories, apply mitigations, and update when fixes become available.
An oss-sec mailing list post disclosed multiple CUPS vulnerabilities, highlighting CVE-2026-34980 and CVE-2026-34990 and recommending mitigations such as limiting network exposure and using confinement controls.
By April 5, public commits containing fixes for the newly disclosed CUPS vulnerabilities had been published, although no fixed CUPS release was yet available.
OpenPrinting published security advisories for multiple CUPS vulnerabilities, including CVE-2026-34980 and CVE-2026-34990, describing an unauthenticated remote-to-root attack chain affecting CUPS 2.4.16 and earlier.
A GitHub security advisory published a proof-of-concept showing how a shared PostScript queue flaw in CUPS 2.4.16 could be exploited to achieve code execution as the lp user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourceseclists.org
Open sourceseclists.org
Open sourcego.theregister.com
Open sourceseclists.org
Open sourceheyitsas.im
Open sourcegithub.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
A critical vulnerability in HP Linux Imaging and Printing (**HPLIP**), tracked as **`CVE-2026-14544`**, allows unauthenticated remote attackers to trigger arbitrary code execution, privilege escalation, denial of service, or memory corruption by sending specially crafted print data to the **`hpcups`** processing path. The bug is an integer overflow (**`CWE-190`**) and has been rated **CVSS 9.8**. Researchers and downstream reporting described it as an incomplete fix for the earlier **`CVE-2026-8631`**, meaning prior remediation did not fully eliminate the underlying issue. The flaw affects HPLIP versions prior to **`3.26.4`** and has broad exposure because HPLIP is widely deployed on Linux systems that support HP printers. Upstream reportedly fixed the issue in **`3.26.4`**, while Linux vendors including Ubuntu, Debian, SUSE/openSUSE, Oracle Linux, and Red Hat have identified affected products or begun issuing and backporting updates; Red Hat said **RHEL 8, 9, and 10** are affected, while **RHEL 6 and 7** are not. Until patches are fully available across distributions, defenders have been urged to apply vendor security updates as they are released, restrict network exposure to printing services such as CUPS, isolate print servers, monitor print activity, and remove HPLIP where it is not required.
Jul 9, 2026
Germany's dCERT issued advisories for **multiple vulnerabilities in CUPS**, the Common UNIX Printing System used across Linux and Unix-like environments. The notices indicate that flaws were identified in the printing stack that could be abused to disrupt service availability, affecting systems that rely on CUPS for print management and related network printing functions. A follow-up advisory specified that the CUPS vulnerabilities can allow **denial-of-service** conditions, raising the risk of printer service crashes or broader printing outages on exposed hosts. Organizations using CUPS should review vendor guidance, identify affected packages and versions, and prioritize patching or other mitigations to reduce the likelihood of service disruption.
Jun 29, 2026