CVE-2026-1997 HP OfficeJet Pro CORS Misconfig Grants UnAuth Cross-Origin Access
CVE-2026-1997 Published on February 10, 2026
Certain HP OfficeJet Pro Printers - Information Disclosure
Certain HP OfficeJet Pro printers may expose information if CrossOrigin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Proclass devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
Weakness Type
Origin Validation Error
The software does not properly verify that the source of data or communication is valid.
Affected Versions
HP Inc HP OfficeJet Pro 8730 All-in-One Printer:- Before <001.2602B is affected.
- Before <001.2602B is affected.
- Before <001.2602B is affected.
- Before <001.2602B is affected.
- Before <002.2602A is affected.
- Before <002.2602A is affected.
- Before <002.2602A is affected.
- Before <001.2602A is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.