AiCybr

HP Advance HPSBPI04149: Update AC Print & Scan and Output Central

By AiCybr Editorial · Published September 18, 2026

HP has released security bulletin HPSBPI04149 Rev. 1 for three vulnerabilities in HP Advance software that can affect the server hosting HP AC Print & Scan and HP Output Central. Two flaws, CVE-2026-89082 and CVE-2026-89083, carry CVSS 4.0 scores of 9.3 (Critical); CVE-2026-89084 is 8.8 (High).

The remediation boundary is straightforward: update HP AC Print & Scan to V1R4.0.027 or later and HP Output Central to V1R4.0.029. HP directs customers to obtain the updated software through E-SW Ops Support, as listed in the September 16 bulletin.

All three CVSS vectors describe a network attack vector, low attack complexity, no attack requirements, no privileges required and no user interaction. Administrators running either product should therefore treat the server update as the primary remediation step and verify the installed build rather than relying on perimeter exposure alone.

Fixed versions

Product Affected range in HP's CVE records Updated software
HP AC Print & Scan Versions before V1R4.0.027 V1R4.0.027 or later
HP Output Central Versions before V1R4.0.029 V1R4.0.029

HP's bulletin instructs customers to contact E-SW Ops Support to obtain the software updates. Organizations should inventory every HP Advance server, record its installed product build and schedule the vendor update through the normal change-management process.

Three vulnerabilities share the same update boundary

HPSBPI04149 groups three CVEs affecting the same two HP Advance products. The vendor records describe potential elevation of privilege, remote code execution or arbitrary file write under certain conditions on the server hosting the software.

CVE CVSS 4.0 CWE Vendor-scored impact profile
CVE-2026-89082 9.3 Critical CWE-94, code generation/control High confidentiality, integrity and availability impact on the vulnerable system
CVE-2026-89083 9.3 Critical CWE-94, code generation/control High confidentiality impact, low integrity impact on the vulnerable system, with high confidentiality and integrity impact on subsequent systems
CVE-2026-89084 8.8 High CWE-22, path traversal High integrity and availability impact on the vulnerable system

The shared affected-version ranges make a product-level update more useful operationally than treating the CVEs as three separate patch projects.

CVE-2026-89082

CVE-2026-89082 is classified under CWE-94 and has a CVSS 4.0 score of 9.3. HP's vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

That scoring describes a network-reachable path with low attack complexity and no required privileges or user interaction, with high confidentiality, integrity and availability impact to the vulnerable system. HP's public description groups the potential consequences as elevation of privilege, remote code execution or arbitrary file write under certain conditions.

CVE-2026-89083

CVE-2026-89083 is also classified under CWE-94 and scores 9.3 Critical. Its CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N.

The vector differs materially from CVE-2026-89082: HP scores high confidentiality and low integrity impact on the vulnerable system, plus high confidentiality and integrity impact on subsequent systems. The network, complexity, privilege and interaction metrics remain the same.

CVE-2026-89084

CVE-2026-89084 is a CWE-22 path-traversal issue with a CVSS 4.0 score of 8.8 High. HP's vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.

HP scores high integrity and availability impact to the vulnerable system, with no confidentiality impact in the base vector. It shares the same network attack vector, low complexity and zero-privilege/zero-interaction characteristics as the two Critical flaws.

What administrators should do

  1. Inventory servers running HP AC Print & Scan or HP Output Central and record the installed version.
  2. Update AC Print & Scan installations below V1R4.0.027 to V1R4.0.027 or later.
  3. Update Output Central installations below V1R4.0.029 to V1R4.0.029.
  4. Obtain the vendor software through the E-SW Ops Support contact specified in HPSBPI04149.
  5. Apply normal change-control and backup procedures before updating production print infrastructure.
  6. Until the update is deployed, reduce unnecessary network reachability to the HP Advance server using existing segmentation and access-control policy.
  7. After deployment, verify the running build on each server and retain the version inventory as patch evidence.

HP's bulletin is the authoritative source for the remediation versions. The CVE records and current public bulletin do not establish active exploitation, so incident-response escalation should be based on local telemetry rather than an assumed exploitation campaign.

Operational priority

The two 9.3 Critical scores, network attack vector and lack of required privileges or user interaction justify prompt treatment on reachable HP Advance servers. Priority should be highest for installations accessible from broad enterprise networks or other less-trusted segments and for systems whose print workflows connect to sensitive business data.

The update is also unusually easy to scope: both affected products have a single first-fixed build boundary in HP's bulletin. That gives administrators a direct compliance check—identify the product, compare its version with the fixed release, update, and verify the resulting build.

Bottom line

HP's September 16 HPSBPI04149 bulletin covers three serious HP Advance vulnerabilities across AC Print & Scan and Output Central. CVE-2026-89082 and CVE-2026-89083 are Critical at 9.3; CVE-2026-89084 is High at 8.8.

For remediation, move HP AC Print & Scan to V1R4.0.027 or later and HP Output Central to V1R4.0.029, using the update channel specified by HP. The common version boundary lets administrators remediate the complete bulletin as one server-software update project.

Sources

Continue reading

Cybersecurity ServiceNow August 2026 Critical CVEs: What to Patch and Why

ServiceNow patched three CVSS 10.0 flaws and a sandbox escape affecting AI Platform and Now Platform releases. Here is the operator-focused version map and remediation checklist.

Cybersecurity SAP September 2026 Patch Day Fixes 4 Critical Flaws, Including CVSS 10.0 EPP Bug

SAP released 19 new security notes on September 8, 2026, including four Critical vulnerabilities affecting Extended Passport processing, NetWeaver Message Server, CAP multitenancy and SAP GUI for Java. See affected versions, note IDs and patch priorities.

Cybersecurity Jenkins Script Security CVE-2026-92122 Cluster: Upgrade to 1422.v06869826dd9b_

Jenkins Script Security 1415.v9a_f9b_3a_c253d and earlier has multiple sandbox bypasses that can lead to controller-JVM code execution. See the fixed build, affected permissions and remediation.