CVE-2026-42626 HP CVE debrief

Who should care

Organizations using HP ENVY 5000 series printers should prioritize patching this vulnerability to prevent potential disruptions. Network administrators and security teams responsible for printer management should be aware of this issue and take necessary precautions.

Technical summary

The HP ENVY 5000 series printers, specifically VERBASPP1N003.2237A.00, do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated remote attacker on the same network can establish a persistent connection to port 9100 and send keep-alive packets, causing the printer's session threads to remain locked in a waiting state. The firmware lacks connection timeouts and concurrent session limits, resulting in a persistent Denial of Service (DoS) that renders the printer unresponsive to all user commands and print jobs. Physical intervention (manual restart) is required to restore functionality, and the attack can be immediately re-initiated.

Defensive priority

Medium priority should be given to patching this vulnerability, as it can cause significant disruptions to printing services.

Recommended defensive actions

• Apply the vendor-provided patch or firmware update to address the vulnerability.
• Implement network segmentation to limit the attack surface.
• Monitor printer logs for suspicious activity.
• Consider disabling JetDirect/RAW printing if not necessary.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-05-22T17:16:47.500Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Awaiting Analysis. Limited details are available about the affected scope and vendor remediation efforts.

Official resources