CVE-2026-1997 Certain HP OfficeJet Pro Printers - Information Disclosure
Misconfigured CORS on HP OfficeJet Pro printers allows unauthorized web origins to access device resources, requiring administrators to keep CORS disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1997?
CVE-2026-1997 is a medium-severity vulnerability in HP OfficeJet Pro 7720 Wide Format All-in-One Printer series, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
Weakness: CWE-346
Which versions are affected by CVE-2026-1997?
It affects 41 products.
Products include Hp D9l18a Firmware, Hp D9l20a Firmware, Hp D9l21a Firmware, Hp D9l63a Firmware, Hp D9l64a Firmware, Hp G5j38a Firmware and 35 more.
How do I fix CVE-2026-1997?
No fix has been published for CVE-2026-1997 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-1997 being exploited?
There is no known exploitation of CVE-2026-1997 in the wild and no public exploit code.
Other vulnerabilities in HP OfficeJet Pro 7720 Wide Format All-in-One Printer series
Sources
Also known as GHSA-993x-2cg3-pv23.