CVE-2026-63563 Misconfiguration in Sharp MFPs
Attackers can access address book and document filing features without authentication on certain Sharp and Toshiba MFPs due to disabled user authentication in the initial configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63563?
CVE-2026-63563 is a medium-severity vulnerability in Sharp MFPs, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication. Products intended for the Japanese market are not affected.
Weakness: CWE-1188
Which versions are affected by CVE-2026-63563?
How do I fix CVE-2026-63563?
No fix has been published for CVE-2026-63563 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63563 being exploited?
There is no known exploitation of CVE-2026-63563 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hj84-h226-g524.