CVE-2026-89083

HP has disclosed code-injection flaws (CWE-94) in HP Advance server software that, under certain conditions, can lead to elevation of privilege, remote code execution, or arbitrary file writes on the server hosting the product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaws are triggerable remotely over a network with low attack complexity, no privileges required, and no user interaction. A successful attacker could gain highly confidential read access on the server and achieve high confidentiality and integrity impact on subsequent (connected) systems, enabling privilege escalation, code execution, or malicious file placement. Any organization running HP Advance, an enterprise print/output-management platform typically hosted on an on-premises server, is affected. No public proof-of-concept is known and the issue is not listed in CISA's KEV, so exploitation has not been confirmed.

What to do: Upgrade HP Advance to the fixed release identified in the HP security bulletin, since the advisory data available here does not specify affected or fixed version numbers. Restrict network access to the Advance server (internal or VPN only, not directly internet-exposed) and check server logs for unauthenticated requests or unexpected file writes. Given the high confidentiality and subsequent-system impact ratings, also review accounts and adjacent systems reachable from the Advance host after patching.