CVE-2026-89084 · Security advisory · 16 September 2026
An unauthenticated device-synchronisation operation writes and deletes .xml files at an attacker-chosen path as SYSTEM
A SOAP operation that requires no authentication uses caller-supplied values to build file paths, allowing an unauthenticated remote caller to write and delete .xml files anywhere the service account can reach.
Summary
A device-synchronisation operation on the MFPsecure SOAP service requires no authentication and runs with local system privileges. Two of the values the caller supplies are used to build the destination path for a file the operation writes, and one is used to build the path of a file it deletes. Neither is validated, so a caller who supplies a relative path escapes the intended directory.
The written file is forced to an .xml extension. That is the only constraint: within it, the
destination path and the file contents are both chosen by the caller, as is the path of the file
deleted.
Impact
Demonstrated on a pristine installation with no prior test history, driven from a separate host
over plaintext HTTP with no Authorization header and no credentials:
- A file was written at the intended location with contents supplied by the caller.
- A second request escaped that directory and wrote to an unrelated system path. The resulting file was owned by the privileged account the service runs as. That is a location and ownership an unauthenticated remote caller should not be able to produce.
Both files were removed afterwards and the system reverted.
What was proven is unauthenticated remote file write and file deletion at an attacker-chosen
path, as a privileged account, with the written file forced to an .xml extension.
Affected
| Product line | Status |
|---|---|
| HP Advance / HP Output Central R4 | Affected through V1R4.0.026 |
| HP Advance R3 | Affected, confirmed on V1R3.0.033 |
Vendor-stated fix
| Product | Vendor-stated fix |
|---|---|
| HP AC Print & Scan | V1R4.0.027 or later |
| HP Output Central | V1R4.0.029 or later |
I have not verified these builds. HP named them but has not provided them to me, so I cannot confirm the issue is closed in either one. The versions above are HP’s statement, not my finding.
No R3 fix has been named. As with CVE-2026-89082, this issue
was reported to HP as reproducing on R3 V1R3.0.033 on 29 June 2026, and the remediation
HP named covers R4 builds only. R3 operators should treat this as unpatched.
Mitigation
Apply the vendor update. Network isolation is worth doing generally, but it does not cleanly apply here. The affected surfaces share their endpoints and ports with traffic that the devices and end users require, so restricting by address or by port removes scanning or print release without removing the exposure. A homegrown control would have to filter each affected request individually and be maintained as the product changes, which is a stopgap rather than a fix.
Technical detail
Held, in line with the other disclosures published in this set. See CVE-2026-89082 for why.
Timeline
| Date | Event |
|---|---|
| 2026-06-01 | Reported to HP PSRT |
| 2026-06-10 | Case assigned as HP-PSRT-IR #6393 / PSR-2026-0126 |
| 2026-06-24 | Confirmed still present in the then-current build, V1R4.0.026 |
| 2026-06-29 | R3 applicability reported to HP |
| 2026-07-21 | Validated by HP; fixes in progress |
| 2026-09-14 | CVE assigned and scored by HP |
| 2026-09-16 | Public disclosure |
Credit
Reported by Joseph Chiarchiaro, Independent Security Researcher. CVE assigned and scored by HP Inc. as CNA.