Login Request a demo
Medium severity · published Feb 10, 2026
CVE-2026-1997
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device…
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
D9l18a Firmware · HP
before 001.2602a · source: NVD
DF
D9l20a Firmware · HP
before 001.2602b · source: NVD
DF
D9l21a Firmware · HP
before 001.2602b · source: NVD
DF
D9l63a Firmware · HP
before 001.2602b · source: NVD
DF
D9l64a Firmware · HP
before 001.2602b · source: NVD
GF
G5j38a Firmware · HP
before 001.2602a · source: NVD
GF
G5j56a Firmware · HP
before 001.2602a · source: NVD
JF
J3p65a Firmware · HP
before 001.2602b · source: NVD
JF
J3p66a Firmware · HP
before 001.2602b · source: NVD
JF
J3p67a Firmware · HP
before 001.2602b · source: NVD
JF
J3p68a Firmware · HP
before 001.2602b · source: NVD
JF
J6x76a Firmware · HP
before 001.2602a · source: NVD
Affected product
DF
D9l18a Firmware
HP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1997
Vendor Advisory
https://support.hp.com/us-en/document/ish_14051823-14051849-16/hpsbpi04086
More from D9l18a Firmware
9.8
CVE-2022-28722
Certain HP Print Products are potentially vulnerable to Buffer Overflow
5.3
CVE-2026-1996
Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection