Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-42626

5.9 · MEDIUM

HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).

Published May 22, 2026CWE-400EPSS 0.21%

Overview

CVE-2026-42626 is a medium-severity vulnerability. It was published on May 22, 2026 and has a CVSS 3.1 base score of 5.9 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.9, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical description

HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated remote attacker on the same network can establish a persistent connection to port 9100 and send keep-alive packets, causing the printer's session threads to remain locked in a waiting state. The firmware lacks connection timeouts and concurrent session limits, resulting in a persistent Denial of Service (DoS) that renders the printer unresponsive to all user commands and print jobs. Physical intervention (manual restart) is required to restore functionality, and the attack can be immediately re-initiated.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refmedium.com/@jacobmasse/hp-envy-5000-printer-dos-vulnerability-8cae52c87b41Refjacobmasse.medium.com/hp-envy-5000-printer-dos-vulnerability-8cae52c87b41

How CyberStrike helps

Frequently asked questions

What is CVE-2026-42626?

CVE-2026-42626 is a medium-severity vulnerability. It was published on May 22, 2026 and has a CVSS 3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2026-42626?

This vulnerability has a CVSS 3.1 base score of 5.9, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2026-42626?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-42626?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-42626 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999