Three high-severity vulnerabilities in HP Easy Start for macOS could allow attackers to interfere with printer-software installation workflows and potentially gain elevated privileges. The flaws affect versions earlier than 2.16.7.260722, and HP has released a patched version to address them.
The vulnerabilities are tracked as CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556. They affect the application’s download mechanism, temporary-file handling, and network transport settings.
HP Easy Start for macOS can expose privileged installation operations to attacks targeting files or software packages handled with administrative permissions.
CVE-2026-12554 is the most severe of the three issues, with a CVSS 4.0 score of 8.5. The flaw is classified as CWE-1104, or use of unmaintained third-party components. Researchers found that the vulnerable application included an OSPFTP download stack in its software-installation workflow.
The component supported fallback download schemes, including FTP. FTP does not encrypt transferred data and does not provide modern integrity protections.
An attacker positioned on the same network, or able to influence DNS resolution in a controlled scenario, could attempt to interfere with software downloads if the application falls back to FTP.
HP Easy Start Vulnerability
Researchers cautioned that this does not automatically mean every HP Easy Start installation uses FTP or that package-signature checks are always bypassed. However, the presence of an outdated FTP component expanded the attack surface of a privileged installer.
CVE-2026-12555 carries a CVSS score of 7.7 and is linked to CWE-379, an insecure temporary-file issue. The vulnerability affects the HP Uninstaller component, which used predictable file paths under /tmp and /private/tmp while operating with administrator privileges.
A local attacker with access to the Mac could prepare a symbolic link at one of these predictable locations before a legitimate user runs the HP uninstaller.
Once the user approves the administrator prompt, the elevated process may follow the attacker-controlled link and write application-generated log data to the selected destination.
The result is best described as privileged file modification or corruption, rather than unrestricted root-level file writing. The attacker can control the destination path, but not fully control the contents written by the application.
Still, modifying sensitive configuration or service-related files could cause denial-of-service conditions or support further attacks in certain environments.
The third flaw, CVE-2026-12556, is rated 7.7 under CVSS 4.0 and maps to CWE-319, cleartext transmission of sensitive information. The vulnerable build had relaxed macOS App Transport Security settings globally via the NSAllowsArbitraryLoads option. This setting can allow insecure HTTP connections that macOS would normally restrict.
Combined with the FTP fallback capability, the relaxed transport policy increased the possibility of cleartext software delivery. A network-positioned attacker could manipulate downloaded components under fallback conditions, particularly if other package-integrity controls are weak or incorrectly enforced.
Security researcher Nir Yehoshua of Cipher Security Labs discovered the issues during an assessment of HP Easy Start version 2.16.0, build 251010.
HP fixed the three vulnerabilities in HP Easy Start version 2.16.7.260722. The updated release reportedly removes the vulnerable uninstaller paths, the OSPFTP download component, and tightens the application’s transport security configuration. HP’s advisory was published on August 24, 2026.
Organizations and individual Mac users should update HP Easy Start to version 2.16.7.260722 or later. Administrators should also review systems where older HP printer installation utilities may still be present, especially shared Macs, where local attackers could access temporary directories, or enterprise networks, where unencrypted traffic may be exposed.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post 3 High-Severity HP Easy Start Flaws Let Attackers Escalate Privileges on macOS appeared first on Cyber Security News.