HP vulnerabilities
We track 168 vulnerabilities in HP products across 60+ products. 168 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 23, 2026.
Latest HP vulnerabilities
- 8.5 High severity
Sound Research: Incorrect Privilege Assignment
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities
- 7.2 High severity
HP Sure Start IFD Protection: Missing Authentication for Critical Functionality
A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiality, or denial of servic
- 7.8 High severity
HP Support Assistant: Improper Privilege Management
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
- 9.8 Critical severity
HyperX NGENUITY: Improper Neutralization of Special Elements used in an OS Command
HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vulnerability.
- 9.8 Critical severity
Poly Lens: Improper Control of Resource Identifiers
A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
- 8.4 High severity
HP Hotkey Support Software: Improper Link Resolution Before File Access
A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.
- 7.3 High severity
Certain HP PC Products: Improper Restriction of Software Interfaces to Hardware Features
A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that requires specialized eq
- 9.1 Critical severity
HP Linux Imaging and Printing Software: Improper Verification of Cryptographic Signature
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
- 7.2 High severity
Poly Clariti Manager: Improper Neutralization of Special Elements used in an SQL Command
A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow a privileged user to execute SQL commands. HP has addressed the issue in the latest software update.
- 7.8 High severity
HP Support Assistant: Improper Privilege Management
A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
- 7.5 High severity
Universal Print Driver: Stack-based Buffer Overflow
HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).
- 7.8 High severity
HP Support Assistant: Improper Preservation of Permissions
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
- 7.8 High severity
HP Touchpoint Analytics Service: Improper Link Resolution Before File Access
A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing softwa
- 7.5 High severity
HP LaserJet MFP M232-M237 Printer Series: Improper Handling of Unexpected Data Type
The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).
- 9.8 Critical severity
Certain HP LaserJet Pro, HP LaserJet…: Out-of-bounds Write
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
- 9.8 Critical severity
Certain HP LaserJet Pro, HP LaserJet…: Stack-based Buffer Overflow
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
- 9.8 Critical severity
Certain HP LaserJet Pro, HP LaserJet…: Stack-based Buffer Overflow
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
- 8.5 High severity
HP Anyware Linux Agent: Improper Check for Dropped Privileges
A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability.
- 9.8 Critical severity
Trellix Enterprise Security Manager (ESM): Improper Neutralization of Special Elements used in an OS Command
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.
- 7.5 High severity
Certain Poly Video Conference Devices: Improper Neutralization of Special Elements used in a Command
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
- 9.8 Critical severity
HP Smart Universal Printing Driver: Out-of-bounds Write
Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A client using the HP Smart Universal Printing Driver that sends a print job comprised of a malicious X
- 8.8 High severity
HP Hotkey Support: Improper Link Resolution Before File Access
A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update
- 8.0 High severity
HP One Agent Software: Untrusted Search Path
A potential security vulnerability has been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability.
- 7.8 High severity
Samsung Universal Print Driver: Improper Privilege Management
The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018.
- 9.8 Critical severity
HP Security Manager: Improper Control of Generation of Code
HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.
- 9.8 Critical severity
Poly Clariti Manager: Improper Access Control
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls.
- 9.8 Critical severity
HPE Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leadin
- 9.8 Critical severity
HPE Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to compl
- 9.8 Critical severity
Hpe Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to compl
- 8.8 High severity
Poly Clariti Manager: Unrestricted Upload of File with Dangerous Type
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input.
- 9.8 Critical severity
Certain HP PC Products: Buffer Copy without Checking Size of Input
A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate t
- 7.8 High severity
Plantronics Hub: Improper Link Resolution Before File Access
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privilege
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.
- 8.8 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 8.8 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.