HP DesignJet T3500 XSS Vulnerability Advisory (CVE-2026-18243)

Vulnerability Overview Vulnerability Name: HP DesignJet T3500 - Potential Cross-Site Scripting (XSS) Vulnerability Type: Cross-Site Scripting (XSS) Severity: Medium HP Reference ID: HPSBP04133 Rev. 1 Publication Date: July 31, 2026 Last Update Date: July 31, 2026 Category: Printing Potential Security Impact: Information Disclosure Reported By: Chandler Johnson Impact Scope Affected CVE ID: CVE-2026-18243 CVSS Score: 6.8 Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VH:L/SC:N/SI:N/SA:N Affected Firmware Version: AENEAS_04_09_09.1.fmw Affected Products: HP DesignJet T3500 (Model Numbers: B9E24A, B9E24B, B9E25A) Remediation Update Printer Firmware: HP has provided a firmware update for potentially affected products. Please visit the HP download page, search for your printer model, and update the firmware to the latest version. Additional Information Third-Party Security Patches: Customers should install third-party security patches on systems running HP software products in accordance with their patch management policies. Support: For questions regarding the implementation of recommendations in this security bulletin, please visit the HP Support Page. Reporting: To report potential security vulnerabilities in HP support products, please email hp-security-alert@hp.com. Security Bulletin Archive: To view published security bulletins, please visit the HP Security Bulletins Page. Legal Information: System administration and security procedures must be regularly reviewed to maintain system integrity. HP continuously reviews and enhances the security features of its software products to provide customer service consistent with current security solutions. Additional Support Options Automation Tools or Diagnostics: Try using HP’s automation tools or diagnostics. Community Page: Ask questions on the HP Support Community page. Contact Support Agent: Contact a support agent. Knowledge Base Search Search Topic: Enter a topic to search the knowledge base. --- Note: The page does not include Proof-of-Concept (POC) code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

HP DesignJet T3500 XSS Vulnerability Advisory (CVE-2026-18243)