CVE-2026-1997
Medium
Description
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
SeverityMedium
CVSS5.3
Exploit probability—
ProductHp M9l65a Firmware
PublishedFeb 10, 2026
First seenFeb 10, 2026
Weakness typeCWE-346CWE-346
How to fix
Update
- hp m9l65a_firmware001.2602a or later
- hp d9l20a_firmware001.2602b or later
- hp k7s32a_firmware001.2602b or later
- hp d9l21a_firmware001.2602b or later
- hp k7s42a_firmware001.2602b or later
- hp t0g65a_firmware001.2602b or later
- hp k7s39a_firmware001.2602b or later
- hp j6x83a_firmware001.2602b or later
- hp k7s43a_firmware001.2602b or later
- hp k7s40a_firmware001.2602b or later
- hp k7s41a_firmware001.2602b or later
- hp t0g56a_firmware001.2602b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hp m9l65a_firmware | v < 001.2602a | 001.2602a |
| hp d9l20a_firmware | v < 001.2602b | 001.2602b |
| hp k7s32a_firmware | v < 001.2602b | 001.2602b |
| hp d9l21a_firmware | v < 001.2602b | 001.2602b |
| hp k7s42a_firmware | v < 001.2602b | 001.2602b |
| hp t0g65a_firmware | v < 001.2602b | 001.2602b |
| hp k7s39a_firmware | v < 001.2602b | 001.2602b |
| hp j6x83a_firmware | v < 001.2602b | 001.2602b |
| hp k7s43a_firmware | v < 001.2602b | 001.2602b |
| hp k7s40a_firmware | v < 001.2602b | 001.2602b |
| hp k7s41a_firmware | v < 001.2602b | 001.2602b |
| hp t0g56a_firmware | v < 001.2602b | 001.2602b |
| hp d9l63a_firmware | v < 001.2602b | 001.2602b |
| hp d9l64a_firmware | v < 001.2602b | 001.2602b |
| hp j3p65a_firmware | v < 001.2602b | 001.2602b |
| hp j3p66a_firmware | v < 001.2602b | 001.2602b |
| hp j3p67a_firmware | v < 001.2602b | 001.2602b |
| hp j3p68a_firmware | v < 001.2602b | 001.2602b |
| hp t0g70a_firmware | v < 001.2602b | 001.2602b |
| hp g5j38a_firmware | v < 001.2602a | 001.2602a |
| hp t1p99a_firmware | v < 001.2602a | 001.2602a |
| hp l3t99a_firmware | v < 001.2602a | 001.2602a |
| hp y0s19a_firmware | v < 001.2602a | 001.2602a |
| hp g5j56a_firmware | v < 001.2602a | 001.2602a |
| hp y0s18a_firmware | v < 001.2602a | 001.2602a |
| hp d9l18a_firmware | v < 001.2602a | 001.2602a |
| hp m9l66a_firmware | v < 001.2602a | 001.2602a |
| hp m9l67a_firmware | v < 001.2602a | 001.2602a |
| hp t0g46a_firmware | v < 001.2602a | 001.2602a |
| hp j6x76a_firmware | v < 001.2602a | 001.2602a |
| hp j6x78a_firmware | v < 001.2602a | 001.2602a |
| hp j6x80a_firmware | v < 001.2602a | 001.2602a |
| hp k7s37a_firmware | v < 001.2602a | 001.2602a |
| hp m9l70a_firmware | v < 001.2602a | 001.2602a |
| hp j6x77a_firmware | v < 001.2602a | 001.2602a |
| hp j6x81a_firmware | v < 001.2602a | 001.2602a |
| hp j6x79a_firmware | v < 001.2602a | 001.2602a |
| hp k7s38a_firmware | v < 001.2602a | 001.2602a |
| hp t0g47a_firmware | v < 001.2602a | 001.2602a |
| hp t0g48a_firmware | v < 001.2602a | 001.2602a |
| hp t0g49a_firmware | v < 001.2602a | 001.2602a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.