TI-2026-61888 Aliases CVE-2026-91104 GHSA-4g7p-h353-2q55

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

MEDIUM 50CWE-122Published 2026-09-16 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01071 65th percentileScored 2026-11-07

Fix Partial HP Linux Imaging and Printing Software (HPLIP) (HP Inc.): 3.26.6Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hewlett Packard Enterprise	HP Linux Imaging and Printing Software (HPLIP)	before 3.26.6	3.26.6	Patch available	CNA

HP Linux Imaging and Printing Software (HPLIP) VendorHewlett Packard Enterprise Affected before 3.26.6 Fixed in 3.26.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hp:linux_imaging_and_printing::::::::	before 3.26.6	Vulnerable	Hewlett Packard Enterprise

cpe:2.3:a:hp:linux_imaging_and_printing:*:*:*:*:*:*:*:* Versions before 3.26.6 Vulnerable ·Hewlett Packard Enterprise

Remediation

Fix · CNA HP Linux Imaging and Printing Software (HPLIP) (HP Inc.) Fixed in 3.26.6

Red Hat 3 advisories

RHSA-2026:82882 Released 2026-10-14 · Red Hat rating Important
hplip security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) hplip-3.26.6-1.el9_8.3, hplip-libs-3.26.6-1.el9_8.3, libsane-hpaio-3.26.6-1.el9_8.3
RHSA-2026:82883 Released 2026-10-14 · Red Hat rating Important
hplip security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) hplip-3.26.6-1.el10_2.3, hplip-libs-3.26.6-1.el10_2.3, libsane-hpaio-3.26.6-1.el10_2.3
RHSA-2026:82295 Released 2026-10-13 · Red Hat rating Important
hplip security update
- Red Hat Enterprise Linux AppStream (v. 8) hplip-3.26.6-3.el8_10, hplip-gui-3.26.6-3.el8_10, hplip-libs-3.26.6-3.el8_10 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-16
HP Linux Imaging and Printing Software (HPLIP) 3.26.6
10 records Highest priority Priority MEDIUM 5 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-61890 HP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesPriority MEDIUM 50
- TI-2026-61889 HP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesPriority MEDIUM 41
- TI-2026-61882 HP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesPriority MEDIUM 41
Show all 10 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:82883
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2026:82295
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:82882

Not affected: 3 products

Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream (v. 9)

Timeline

2026-10-02 Threatist record created from CVE-2026-91104
2026-10-03 Alias added: GHSA-4g7p-h353-2q55
2026-10-14 Fix available: RHSA-2026:82882 · Red Hat
2026-10-15 Fix available: RHSA-2026:82883 · Red Hat
2026-10-16 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
2026-10-25 Fix available: RHSA-2026:82295 · Red Hat
2026-10-25 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat

References

Advisory 1

https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151

TI-2026-07587 HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution CVSS 4.0CRITICAL 9.3
TI-2026-61890 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities CVSS 4.0CRITICAL 9.3
TI-2026-07588 HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution CVSS 4.0HIGH 8.5
TI-2015-00780 The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for… CVSS 3.0HIGH 8.1
TI-2026-61889 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities CVSS 4.0HIGH 8.6
TI-2026-61882 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities CVSS 4.0HIGH 8.6

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences