CVE-2026-91099

Executive Summary

CVE-2026-91099 is a cluster of externally reported vulnerabilities within HP's HPLIP (HP Linux Imaging and Printing) software stack, as disclosed by HP. The advisory states that multiple components are affected and that exploitation could enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. No CVSS score, affected version range, public proof-of-concept, or atomic patch reference was included in the source data, so defenders must treat this as a high-uncertainty, multi-impact disclosure affecting Linux/Unix print infrastructure and the administrators who operate it.

Technical Analysis

The NVD description is a vendor-level aggregate statement rather than a per-component technical disclosure. It explicitly states that HP "identified and remediated multiple externally reported vulnerabilities within HPLIP" and that "several software components" are affected. The stated consequence classes are: remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. Beyond these impact categories, insufficient technical detail is available to attribute any individual flaw to a specific function, binary, daemon, or configuration file. No CNA title, no per-vulnerability vector, and no component list were provided.

The only machine-readable classification supplied is CWE-61. CWE-61 is UNIX Symbolic Link (Symlink) Following. This is a link-resolution/insecure-file-operation weakness class: a privileged process opens, writes to, or deletes a path that is, or is replaced by, a symbolic link, causing the operation to be redirected to an attacker-chosen target. Where the privileged process is setuid, a system daemon, or running as root, symlink following is a canonical local privilege-escalation and file-clobbering primitive — it maps directly to the "privilege escalation" and "unauthorized file modification" impacts named in the HP description, and to denial of service where the clobbered target is a critical file.

Two important caveats must be stated plainly rather than papered over:

1. CWE-61 is a partial classification. CWE-61 alone does not explain the "remote code execution" or "information disclosure" impacts named in the description. Those impacts likely map to other weaknesses in the same aggregate advisory (for example, network-reachable parsing or IPC flaws in print/scan components) that were not individually itemized in the data provided. This report does not speculate on which components those are.
2. No patch evidence exists in any tracked source. Patch confidence is 0/4 (UNPATCHED). HP's advisory language asserts that findings were "identified and remediated," but no patched version string, commit, or release reference was supplied to any tracked feed. Until a concrete versioned fix is confirmed against the vendor advisory, treat deployed HPLIP versions as potentially affected.

Attack surface context: HPLIP ships a printing/scanning framework, a privileged helper layer, and network-facing tooling. Components within such a stack commonly run as root on workstations and print servers, and network print services frequently listen on well-known ports (classically 631 for IPP/CUPS-adjacent stacks). These two properties — privileged local execution and network reachability — are exactly the combination that turns an aggregate multi-CWE disclosure into a meaningful enterprise risk, but the specific vulnerable interface is not identified in the provided data.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is associated with CVE-2026-91099. The following chain is therefore described at the vulnerability-class level and is explicitly inferred from the CWE-61 classification and the impact list in the NVD description, not from observed exploit code.

1) Reconnaissance / target identification. An attacker first determines whether HP print infrastructure is present and reachable. On a local host, HPLIP components and their privileges are enumerable by any user; on the network, print-related services are fingerprintable via banners, protocol handshakes, and version data. The attacker's goal at this stage is to confirm an HPLIP install and to identify which components execute with elevated privileges.

2) Triggering the flaw class. For the symlink-following (CWE-61) weakness: the attacker places a symbolic link at a filesystem path that an HPLIP component operates on. Because CWE-61 concerns the resolution of a path, the attacker does not need to control the file contents — only the link placement and the timing. When the privileged component performs its file operation (open/write/delete) on that path, the kernel resolves the link and the operation lands on the attacker's chosen target. This can be done entirely locally by a low-privileged user, which is why CWE-61 is a classic LPE primitive. For the other impact classes named by the vendor (RCE, DoS, info disclosure), the trigger surface is presumably network- or IPC-reachable, but the specific entry point is not described in the source data and is not fabricated here.

3) Execution / payload level. At the vulnerability-class level, successful symlink following yields one of: overwrite or truncation of a root-owned file (enabling privilege escalation if a configuration, authorization, or startup file is clobbered), arbitrary file read via a redirected path (information disclosure), or destruction of a critical file (denial of service). The vendor's inclusion of "remote code execution" implies at least one component accepts attacker-influenced input through a remote channel; that specific mechanism is unstated.

4) Post-exploitation impact. Depending on which class is triggered: escalation from an unprivileged local account to root (via clobbered privileged configuration or redirect targets), lateral movement if the compromised host is a shared print server, exfiltration of files readable by the privileged component, or suppression of printing/scanning services across a fleet. The blast radius for print infrastructure is often underestimated: print servers are frequently domain-joined, hold cached credentials, and are reachable from user VLANs.

Impact Assessment

Because NVD supplies no CVSS score or vector for CVE-2026-91099, no temporal or environmental subscores can be cited. Per the critical accuracy constraints, no substitute score is invented.

Qualitatively, the vendor's own impact list spans the full severity spectrum: RCE (critical), privilege escalation (high), denial of service (moderate–high), information disclosure (moderate–high), and unauthorized file modification (moderate–high). Aggregated advisories that span this range should be triaged at the highest named impact.

Affected systems: Linux and Unix hosts running the HPLIP software stack — enterprise print servers, shared lab/workstation fleets, and any endpoint where the printing stack is deployed. Business impact includes: (a) compromise of a shared, often privileged service host; (b) potential domain-wide exposure where print servers are joined to centralized identity infrastructure; (c) service disruption across printing and scanning workflows; and (d) compliance exposure for unauthorized file modification on hosts subject to integrity requirements. Blast radius is highest in environments where HPLIP is centrally managed and where print servers are reachable from broad network segments.

EPSS is not yet scored by FIRST.org; no probability estimate is fabricated. CISA KEV status is NO; there is no evidence in the provided data of exploitation in the wild, and no threat actor campaign is attributed.

Detection Guidance

Detection of CWE-61 at scale is predominantly host-based: the weakness manifests as a privileged process resolving a symlink. Network detections are necessarily precautionary because the specific remote entry point is not identified in the source data. All rules below are detection scaffolding written against the vulnerability class and the vendor's stated impact list; they will require tuning to the confirmed component once HP publishes per-CVE detail.

Sigma Rule

title: Suspicious Symlink Creation Targeting HPLIP Paths
id: 6a2f1c8e-3b40-4d7e-9c11-91099hplip
status: experimental
description: Detects creation of symbolic links in or near HPLIP-related directories, consistent with CWE-61 symlink-following preparation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91099
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_symlink:
    type: 'SYMLINK'
  selection_path:
    name|contains:
      - '/etc/hp'
      - '/usr/share/hplip'
      - '/var/lib/hp'
      - '/tmp/hp'
  condition: selection_symlink and selection_path
falsepositives:
  - Legitimate package management or installer activity
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1190
  - cwe.61

YARA Rule

rule CVE_2026_91099_HPLIP_Symlink_Exploit_Artifact
{
    meta:
        author = "valtersit.com"
        description = "Scaffold detection for HPLIP symlink-following (CWE-61) exploit artifacts/scripts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91099"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $cve    = "CVE-2026-91099" ascii wide nocase
        $sym1   = "ln -s" ascii nocase
        $hp1    = "hplip" ascii wide nocase
        $hp2    = "/etc/hp/" ascii nocase
        $hp3    = "/usr/share/hplip" ascii nocase
        $lpe    = "privilege escalation" ascii wide nocase
    condition:
        uint32(0) != 0x464c457f and
        (
            $cve or
            (2 of ($sym*, $hp*)) or
            ($sym1 and $hp1)
        )
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 631 (msg:"CVE-2026-91099 HPLIP Print Service Suspicious Request - Possible RCE/Info Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/"; http_uri; dsize:>256; threshold:type both, track by_src, count 15, seconds 60; classtype:attempted-admin; reference:cve,2026-91099; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-91099; sid:91099631; rev:1;)
alert tcp $HOME_NET any -> $HOME_NET 631 (msg:"CVE-2026-91099 HPLIP Internal Print Traffic Anomaly - High Volume"; flow:to_server,established; content:"|02|"; depth:1; dsize:>1024; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-dos; reference:cve,2026-91099; sid:91099632; rev:1;)

Elastic Detection

process where host.os.type == "linux" and event.type == "start" and
process.name in ("ln", "symlink", "lnk") and
process.args : ("/etc/hp/*", "/usr/share/hplip/*", "/var/lib/hp/*") and
process.parent.name != null

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
(type=SYMLINK OR "symbolic link")
| search name IN ("/etc/hp/*", "/usr/share/hplip/*", "/var/lib/hp/*", "/tmp/hp*")
| stats count min(_time) as first_seen max(_time) as last_seen values(process) as processes by host, user, name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="hplip,cve-2026-91099,">
  <rule id="910990" level="10">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYMLINK</field>
    <regex field="audit.name">/etc/hp/|/usr/share/hplip/|/var/lib/hp/</regex>
    <description>CVE-2026-91099: Possible HPLIP symlink-following (CWE-61) attempt targeting $(audit.name)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>privilege_escalation,pci_dss_10.2.2,</group>
  </rule>
  <rule id="910991" level="12">
    <if_sid>910990</if_sid>
    <field name="audit.uid">0</field>
    <description>CVE-2026-91099: Root-context symlink operation against HPLIP path - high confidence exploitation</description>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). HP's advisory language states the issues were "identified and remediated," but no patched version string, commit, or release artifact was supplied to the tracked feeds. Defenders must therefore verify the fix directly with HP before treating any version as safe.

1) Immediate mitigations.

• Inventory all hosts running HPLIP (servers, print servers, workstations). Prioritize internet- or cross-VLAN-reachable print services.
• Restrict network exposure of print services (classically port 631) to authorized management and user subnets only; do not expose print daemons to untrusted networks.
• Enforce least privilege: ensure print/scan components are not run as root where architecture allows, and audit any setuid/privileged helpers for necessity.
• Harden filesystem symlink handling where configurable: enable kernel symlink protections (e.g., fs.protected_symlinks/fs.protected_hardlinks) on Linux hosts — these are direct, low-cost mitigations against CWE-61 class attacks.
• Monitor /etc/hp, /usr/share/hplip, /var/lib/hp and any temp path used by the print stack for unexpected symlink creation (see detection rules above).

2) Patch / upgrade steps.

• Consult the authoritative HP advisory for CVE-2026-91099 and obtain the exact patched HPLIP version. Do not assume any version is fixed until HP's advisory names it.
• Stage the upgrade on non-production print hosts first; validate printing/scanning functionality before fleet rollout.
• Because the affected version range was not published in the source data, treat all deployed HPLIP versions as candidate-affected until the vendor range is confirmed.
• Re-verify after upgrade that privileged helper components have been reduced or remediated as the advisory claims.

3) Long-term hardening.

• Establish a software bill of materials (SBOM) for print/imaging infrastructure so future HP advisories can be mapped to deployed components immediately.
• Track HP security advisories in your vulnerability management feed and subscribe to NVD CVE monitoring for HPLIP.
• Apply a standing rule that local privilege-escalation primitives in shared services (print, scan, spool) are treated as high priority on multi-user hosts.
• Restrict local user write access to directories consumed by privileged services; symlink attacks require attacker-controlled link placement.

References

• NVD — CVE-2026-91099: https://nvd.nist.gov/vuln/detail/CVE-2026-91099
• MITRE CWE-61 — UNIX Symbolic Link (Symlink) Following: https://cwe.mitre.org/data/definitions/61.html
• HP Security Advisory portal (HPLIP advisories): https://support.hp.com/us-en/security-bulletins
• HPLIP project documentation and releases: https://developers.hp.com/hp-linux-imaging-and-printing
• CISA Known Exploited Vulnerabilities Catalog (status check): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing were associated with CVE-2026-91099 in the source data. EPSS is not yet scored. No threat actor campaign is attributed. All exploitation detail in this report is inferred at the vulnerability-class level from the CWE-61 classification and the impact list in the vendor description; where specifics were unavailable, this report states so rather than substituting fabricated detail.