HP Advance/Output Central Unauth RCE and Auth Bypass Vulnerabilities (CVE-2026-89082/89083)

HP Advance / Output Central Security Vulnerability Disclosure Summary Vulnerability Overview Disclosure Date: September 17, 2026 Vulnerability Types: Unauthenticated SYSTEM RCE (Remote Code Execution), Authorization Bypass, Arbitrary File Write/Delete CVE Numbers: (CVSS 9.3 Critical): Unauthenticated archive path traversal leading to SYSTEM code execution. (CVSS 9.3 Critical): Spoofed request header to bypass local authorization of the GAP service. (CVSS 8.8 High): Unauthenticated file write and deletion. Attack Conditions: All vulnerabilities can be exploited by remote attackers without credentials. Scope of Impact Affected Products: HP Advance HP Output Central Affected Components: service service (for CVE-89083) service (for CVE-89084) Affected Versions: HP AC Print & Scan: or lower HP Output Central: Verification Environment: Confirmed on . Remediation Official Patch: HP has released security bulletin along with remediation information. Fixed Versions: HP AC Print & Scan: HP Output Central: Mitigation Measures: Apply the corresponding R4 updates listed by HP. Restrict network access to the affected services and MPSecure interfaces (allow only legitimate application traffic). Note: Simple address or port restrictions may interfere with functionality and are not a substitute for vendor updates. Code/POC No Code Blocks: The page does not include specific POC code or exploitation code. Attachment Mention: The bottom of the email mentions an attachment (OpenPGP digital signature), but the screenshot does not display its content. Technical Details Note: The page states that "Reproduction code and other technical details are being withheld while the R3 remediation status remains unresolved."

Goal Reached Thanks to every supporter — we hit 100%!

HP Advance/Output Central Unauth RCE and Auth Bypass Vulnerabilities (CVE-2026-89082/89083)