CVE-2026-1996: Certain HP OfficeJet Pro Printers – Denial of Service

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-10 · updated 2026-06-17
Weakness: CWE-703

Description

Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.

Affected products

HP D9L18A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X76A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X77A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X78A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X79A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X80A Firmware: before 001.2602a — fixed in 001.2602a
HP J6X81A Firmware: before 001.2602a — fixed in 001.2602a
HP K7S37A Firmware: before 001.2602a — fixed in 001.2602a
HP K7S38A Firmware: before 001.2602a — fixed in 001.2602a
HP M9L65A Firmware: before 001.2602a — fixed in 001.2602a
HP M9L66A Firmware: before 001.2602a — fixed in 001.2602a
HP M9L67A Firmware: before 001.2602a — fixed in 001.2602a
HP M9L70A Firmware: before 001.2602a — fixed in 001.2602a
HP T0G46A Firmware: before 001.2602a — fixed in 001.2602a
HP T0G47A Firmware: before 001.2602a — fixed in 001.2602a
HP T0G48A Firmware: before 001.2602a — fixed in 001.2602a
HP T0G49A Firmware: before 001.2602a — fixed in 001.2602a

How to fix

Upgrade to a fixed version: HP D9L18A Firmware 001.2602a; HP J6X76A Firmware 001.2602a; HP J6X77A Firmware 001.2602a; HP J6X78A Firmware 001.2602a; HP J6X79A Firmware 001.2602a; HP J6X80A Firmware 001.2602a; HP J6X81A Firmware 001.2602a; HP K7S37A Firmware 001.2602a; HP K7S38A Firmware 001.2602a; HP M9L65A Firmware 001.2602a; HP M9L66A Firmware 001.2602a; HP M9L67A Firmware 001.2602a. Check the vendor advisory for mitigations.

References

https://support.hp.com/us-en/document/ish_14057472-14057502-16/hpsbpi04089

Get alerted when CVE-2026-1996 or the next vulnerability affects your stack