CVE-2026-1997: HP d9l18a Firmware

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

Affected products

  • HP d9l18a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP d9l20a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP d9l21a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP d9l63a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP d9l64a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP g5j38a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP g5j56a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j3p65a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP j3p66a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP j3p67a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP j3p68a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP j6x76a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x77a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x78a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x79a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x80a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x81a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP j6x83a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP k7s32a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP k7s37a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP k7s38a Firmware: before 001.2602a (fixed in 001.2602a)
  • HP k7s39a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP k7s40a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP k7s41a Firmware: before 001.2602b (fixed in 001.2602b)
  • HP k7s42a Firmware: before 001.2602b (fixed in 001.2602b)
  • and 16 more

Published 2026-02-10. Last modified 2026-06-17.