Loading story…
HP patched three high-severity vulnerabilities in HP Easy Start for macOS that affect versions earlier than 2.16.7.260722. The most severe, CVE-2026-12554 (CVSS 8.5), affects an outdated OSPFTP component and could allow a network attacker to interfere with software downloads when the application falls back to FTP. CVE-2026-12556 (CVSS 7.7) globally relaxes macOS App Transport Security, permitting insecure HTTP connections and raising the risk of cleartext or tampered software delivery.
A separate local privilege-escalation issue, CVE-2026-12555 (CVSS 7.7), involves predictable temporary-file paths used by the privileged HP Uninstaller. A local attacker could exploit symbolic links to cause limited modification of files with elevated privileges. HP has released version 2.16.7.260722 to remediate all three issues; organizations should update affected macOS endpoints and review whether older HP Easy Start installations remain deployed.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
HP published a security advisory for CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556, affecting HP Easy Start for macOS versions earlier than 2.16.7.260722. The flaws involve FTP fallback in an outdated download component, predictable privileged uninstaller temporary paths, and relaxed App Transport Security settings.
Nir Yehoshua of Cipher Security Labs published technical details for the three HP Easy Start macOS flaws, including a proof of concept showing root-appended HP log data can be redirected through predictable temporary-file symlinks. The disclosure also documented that version 2.16.7 removes the affected legacy components and uses a signed-client-restricted helper that validates package SHA-256 from an open file descriptor before installation.
HP released HP Easy Start for macOS version 2.16.7.260722 to remediate all three vulnerabilities. The patched release reportedly removes the OSPFTP component and vulnerable uninstaller paths and tightens transport-security configuration.
Nir Yehoshua of Cipher Security Labs identified CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556 while assessing HP Easy Start for macOS version 2.16.0 build 251010, and reported the issues to HP.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcereddit.com
Open sourcecve.org
Open sourcecve.org
Open sourceciphersecuritylabs.com
Open sourceciphersecuritylabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP has fixed two serious vulnerabilities in **HP Linux Imaging and Printing Software (HPLIP)** affecting versions earlier than **`3.26.4`**, including a critical flaw that could enable remote arbitrary code execution and a high-severity issue that could lead to local privilege escalation. HP published the advisory **`HPSBPI04118`** and released **HPLIP `3.26.4`** as the patched version. The most severe issue, **`CVE-2026-8631`**, is an integer buffer overflow in the **`hpcups`** print request processing path that can be exploited remotely and without authentication using specially crafted print data. A second flaw, **`CVE-2026-8632`**, stems from improper neutralization and could be abused by a local low-privileged user through a crafted print request to execute arbitrary commands on the host operating system. Organizations using HPLIP on Linux systems should upgrade to **`3.26.4`** or later immediately.
Jul 24, 2026
HP disclosed two serious vulnerabilities in **HP Linux Imaging and Printing (HPLIP)** that can lead to arbitrary code execution and privilege escalation on Linux hosts using the widely deployed printer and scanner framework. The most severe issue, **`CVE-2026-8631`** with **CVSS 9.3**, is tied to an integer overflow in the **`hpcups`** processing path and could allow an unauthenticated network attacker to send crafted print data that triggers remote code execution or elevated privileges on the target system. A second flaw, **`CVE-2026-8632`** with **CVSS 8.5**, affects script wrappers through improper input validation and allows a local low-privileged user to execute commands as **root**. HP’s advisory **`HPSBPI04118 Rev. 1`** attributes the issues to command injection and buffer overflow classes and says **HPLIP `3.26.4`** contains the fixes. Because HPLIP is commonly preinstalled in enterprise Linux distributions, organizations were urged to inventory affected systems, limit exposure of print service ports, and update software and firmware promptly.
Jul 3, 2026
Hewlett Packard Enterprise released security updates for **HPE Networking Instant On Access Points** to fix two vulnerabilities affecting firmware version `3.2.0.1` and earlier. The most severe issue, **`CVE-2025-37103`**, is a critical hard-coded credentials flaw with a **CVSS score of 9.8** that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin **`HPESBNW04894`** and urged customers to update affected systems. HPE also patched **`CVE-2025-37102`**, a high-severity vulnerability with a **CVSS score of 7.2** that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version `3.2.1.0` or later to reduce the risk of unauthorized access and command execution on exposed access points.
Jul 24, 2026