HP Advance / Output Central: unauthenticated SYSTEM RCE and two additional vulnerabilities (CVE-2026-89082/89083/89084)
HP Advance and Output Central have unauthenticated SYSTEM RCE, an auth bypass, and arbitrary file write flaws.
A Full Disclosure post reports three vulnerabilities in HP Advance and HP Output Central, with HP AC Print & Scan also named in HP's update table. CVE-2026-89082, CVE-2026-89083, and CVE-2026-89084 cover unauthenticated remote code execution as SYSTEM, an authorization bypass, and arbitrary file write or delete. The excerpt does not say the flaws are being exploited.
- Unauthenticated remote code execution as SYSTEM
- Authorization bypass plus arbitrary file write and delete
- CVE-2026-89082, CVE-2026-89083, and CVE-2026-89084
- Affects HP Advance, Output Central, and AC Print & Scan
- Vendors
- HP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89082 | Critical unauthenticated code injection in HP Advance server enables RCE and file writes | 9.3 | — | ||
CVE-2026-89083+1 related CVE | Unauthenticated code-injection RCE and arbitrary file write in HP Advance server | 9.3 group max | — |
From the original article
Posted by Joe via Fulldisclosure on Sep 22 HP Advance / HP Output Central Unauthenticated SYSTEM RCE, authorization bypass, and arbitrary file write/delete CVE-2026-89082, CVE-2026-89083, CVE-2026-89084 ================================================================ SUMMARY ================================================================ Vendor: HP Inc.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.