CVE-2025-26506
CRITICALCVSS 9.8/10EPSS 1.02%
Last modified
CVE-2025-26506 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hp | 4ra85f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra85v Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra86a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra86e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra86f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra87a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra87e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra87f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra88a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra88e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra88f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra89a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra89v Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh48a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh48v Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh51a Firmware | < 6.17.5.34-202412122146 |
| Hp | 499m6a Firmware | < 6.17.5.34-202412122146 |
| Hp | 499m7a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh52a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh53a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh59a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh64a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh64e Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh64f Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh65a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh66a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh67a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh72a Firmware | < 6.17.5.34-202412122146 |
| Hp | 5hh73a Firmware | < 6.17.5.34-202412122146 |
| Hp | 74p25a Firmware | < 6.17.5.34-202412122146 |
| Hp | 74p26a Firmware | < 6.17.5.34-202412122146 |
| Hp | 74p27a Firmware | < 6.17.5.34-202412122146 |
| Hp | 74p28a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra85e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra85a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra84f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra84e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra84a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra83f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra83e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra83a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra82fr Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra82f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra82e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra82a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra81fr Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra81f Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra81e Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra81a Firmware | < 6.17.5.34-202412122146 |
| Hp | 4ra80f Firmware | < 6.17.5.34-202412122146 |
Showing 50 of 95 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-26506?
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
How severe is CVE-2025-26506?
CVE-2025-26506 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.02% probability of exploitation in the next 30 days.
How do I fix CVE-2025-26506?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-26497Unrestricted Upload of File with Dangerous Type vulnerabilit…7.3
- CVE-2025-26498Unrestricted Upload of File with Dangerous Type vulnerabilit…7.3
- CVE-2025-26499Under heavy system utilization a random race condition can o…6
- CVE-2025-2650A vulnerability, which was classified as problematic, has be…6.1
- CVE-2025-26500: Uncontrolled Resource Consumption vulnerability in Wind Ri…4.6
- CVE-2025-26503A crafted system call argument can cause memory corruption.6.7
- CVE-2025-26507Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP Lase…9.8
- CVE-2025-26508Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP Lase…9.8
- CVE-2025-2651A vulnerability, which was classified as problematic, was fo…6.9
- CVE-2025-26511Systems running the Instaclustr fork of Stratio's Cassandra…8.8
- CVE-2025-26512SnapCenter versions prior to 6.0.1P1 and 6.1P1 are suscepti…9.9
- CVE-2025-26513The installer for SAN Host Utilities for Windows versions pr…7.8
Are you affected by CVE-2025-26506?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST