It's like leaving a side door unlocked, but only during the five minutes you're moving furniture in
CVE-2026-12556 affects HP Easy Start for macOS versions prior to 2.16.7.260722. The application set NSAllowsArbitraryLoads=true in its App Transport Security configuration, disabling macOS's built-in HTTPS enforcement, and retained a legacy OSPFTP download component as a fallback. If the primary HTTPS download path fails, the app could fall back to unencrypted FTP to retrieve printer driver packages — exposing that traffic to interception or tampering by a network-adjacent attacker. The flaw was discovered by Nir Yehoshua of Cipher Security Labs during an assessment of version 2.16.0 and is part of a trio of CVEs (CVE-2026-12554, -12555, -12556) addressed in bulletin HPSBPI04124.
A CVSS 4.0 score of 7.7 HIGH appears on some aggregators, but no official vendor CVSS baseline was published. That 7.7 dramatically overstates the real-world risk. HP Easy Start is a consumer/prosumer printer setup utility — it runs transiently during initial printer configuration, not as a persistent service. The attack requires a network-adjacent position *and* the FTP fallback to trigger, a condition the researchers themselves acknowledged does not represent the default path. The researcher disclosure explicitly stated this 'does not automatically imply a universal package-signature bypass or a simple one-click remote compromise.' For an enterprise fleet, this is backlog noise.
4 steps from start to impact.
Attacker gains network-adjacent position
- Network-adjacent position on same LAN as victim
- ARP spoofing or DNS manipulation capability
- Enterprise networks with 802.1X, NAC, or VLAN segmentation block rogue hosts
- Requires attacker to already have internal network access — implies post-initial-compromise
HP Easy Start launches and primary download fails
- User actively running HP Easy Start (transient, not persistent)
- Primary HTTPS download must fail to trigger FTP fallback
- HP Easy Start is only run once during initial printer setup — the exploitation window is minutes, not hours
- The FTP fallback is a legacy path, not the default — most installations never hit it
- Enterprise printer deployments typically use MDM-pushed drivers, not HP Easy Start
MITM intercepts FTP download and substitutes payload
NSAllowsArbitraryLoads=true and FTP in use, the attacker intercepts the unencrypted package download and substitutes a malicious installer package. Because the traffic is cleartext, no TLS stripping is needed. The attacker must serve a convincing replacement payload.- Active MITM on the FTP session
- Crafted malicious installer package ready to serve
- macOS Gatekeeper and code-signing checks may reject unsigned or improperly signed packages
- The researchers explicitly did not confirm a universal package-signature bypass
- Apple notarization requirements on modern macOS further restrict unsigned package execution
Malicious package executes with elevated privileges
- Package passes or bypasses Gatekeeper and notarization
- User approves installer prompt
- Modern macOS (Ventura+) enforces notarization — unsigned packages trigger explicit user warnings
- SIP (System Integrity Protection) limits even root-level changes to protected system paths
- Impact is confined to a single workstation, not lateral
The supporting signals.
| In-the-Wild Exploitation | No evidence. Not listed on CISA KEV. No known campaigns or threat actor usage. |
|---|---|
| Proof of Concept | None public. Nir Yehoshua (Cipher Security Labs) performed the research but no PoC code has been released. The disclosure was coordinated with HP. |
| EPSS Score | 0.00152 — bottom ~15th percentile. Indicates negligible predicted exploitation probability. |
| KEV Status | Not listed. No CISA KEV entry as of 2026-09-03. |
| CVSS Vector (Aggregator) | CVSS 4.0: 7.7 HIGH per some aggregators (cvefeed.io). No official vendor-published CVSS baseline. Vector details not fully published. |
| Affected Versions | HP Easy Start for macOS < 2.16.7.260722. Research conducted on version 2.16.0. |
| Fixed Version | 2.16.7.260722 — released via HP bulletin HPSBPI04124. HP replaced the SWHelper component with SMAppService-managed privileged helper using authenticated XPC and SHA-256 validation. |
| Scanning / Exposure Data | No Shodan/Censys/GreyNoise exposure data — HP Easy Start is a client-side macOS application, not a network service. Not scannable externally. |
| Disclosure Date | 2026-08-24 — coordinated disclosure by Nir Yehoshua, Cipher Security Labs. |
| Reporting Researcher | Nir Yehoshua, Cipher Security Labs. Part of a trio: CVE-2026-12554, CVE-2026-12555, CVE-2026-12556. |
noisgate verdict.
The single most decisive factor is the compounding friction of network-adjacent positioning plus a non-default FTP fallback trigger on a transient consumer utility — the exploitable window is measured in minutes during a one-time printer setup event, and modern macOS Gatekeeper/notarization checks add an additional gate the researchers did not confirm bypassing. This chain requires an already-compromised internal position to attack a non-enterprise tool with single-workstation blast radius.
Why this verdict
- Network-adjacent prerequisite: This is not remotely exploitable from the internet. The attacker must already hold a position on the victim's LAN, which in enterprise environments implies post-initial-access — a compounding downward pressure from any HIGH baseline.
- Transient, non-default attack surface: HP Easy Start runs only during initial printer setup (minutes), and the FTP fallback is a legacy path that does not trigger under normal conditions. The exploitable window is vanishingly small.
- macOS platform defenses: Gatekeeper, notarization, and SIP on modern macOS (Ventura+) add independent gates against unsigned package execution. The researchers explicitly stated the finding 'does not automatically imply a universal package-signature bypass.'
- Role multiplier: HP Easy Start is a consumer/prosumer printer setup utility. (a) *Low-value role:* workstation during printer setup — this is the canonical deployment. (b) *Typical role:* same — it's not a server component. (c) *High-value role:* HP Easy Start does not run on domain controllers, hypervisors, identity providers, CI/CD, backup servers, or any infrastructure tier. It is not a high-value-role component by any definition. Blast radius is single workstation in all deployment scenarios. The floor check does not apply.
- Minimal enterprise footprint: Enterprise printer deployments use MDM-pushed drivers (Jamf, Mosyle, Munki), not HP Easy Start. The affected population in a 10,000-host fleet is likely near zero.
Why not higher?
Upgrading to MEDIUM or higher would require either remote exploitability, a persistent attack surface, confirmed signature bypass, or deployment in a high-value infrastructure role. None of these conditions are met. The attack chain requires four compounding prerequisites (network adjacency, active HP Easy Start session, FTP fallback trigger, Gatekeeper bypass) — each independently unlikely in enterprise environments.
Why not lower?
IGNORE would be appropriate only if the vulnerability were purely theoretical or affected no real deployments. The cleartext transmission weakness is real and confirmed, and there exist non-enterprise environments (home users, small offices without NAC) where the friction is lower. The chain *can* end in root on a workstation if all conditions align, which warrants tracking even if not actively patching.
What to do — in priority order.
- Block FTP outbound at the network perimeter and host firewall — Deny FTP (TCP 20-21) egress from workstation VLANs. This kills the fallback path entirely and costs nothing. No mitigation SLA applies at LOW severity — treat as backlog hygiene.
- Deploy printer drivers via MDM instead of HP Easy Start — Use Jamf, Mosyle, Munki, or Intune to push HP printer drivers as managed packages, bypassing HP Easy Start entirely. This is already best practice for enterprise Mac fleets.
- Enforce macOS Gatekeeper and notarization policy via MDM — Ensure
spctl --master-enableand notarization requirements are enforced fleet-wide. This blocks unsigned or tampered packages even if the MITM succeeds.
- Network segmentation alone — while it raises the bar for the MITM, it doesn't address the root cause (cleartext download capability in the app). An attacker already on the workstation VLAN bypasses this.
- Endpoint firewall rules blocking HP Easy Start — if users need to set up printers, blocking the app creates a support burden without addressing the underlying driver delivery problem.
Crowdsourced verification payload.
Run on any macOS host where HP Easy Start may be installed. No elevated privileges required. Execute: bash check_cve_2026_12556.sh
#!/bin/bash
# CVE-2026-12556 Checker — HP Easy Start for macOS cleartext transport
# Run on target macOS host. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
APP_PATH="/Applications/HP Easy Start.app"
PLIST="$APP_PATH/Contents/Info.plist"
if [ ! -d "$APP_PATH" ]; then
echo "UNKNOWN — HP Easy Start is not installed at $APP_PATH"
exit 2
fi
# Extract version
VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST" 2>/dev/null)
if [ -z "$VERSION" ]; then
echo "UNKNOWN — could not read version from $PLIST"
exit 2
fi
echo "Detected HP Easy Start version: $VERSION"
# Compare versions — fixed version is 2.16.7
# Using sort -V for version comparison
FIXED="2.16.7"
LOWEST=$(printf '%s\n%s' "$FIXED" "$VERSION" | sort -V | head -n1)
if [ "$LOWEST" = "$FIXED" ] && [ "$VERSION" != "$FIXED" ] || [ "$VERSION" = "$FIXED" ]; then
# VERSION >= FIXED
if [ "$VERSION" = "$FIXED" ] || [ "$LOWEST" = "$FIXED" ]; then
echo "PATCHED — version $VERSION >= $FIXED"
exit 0
fi
fi
# Check if version is less than fixed
if [ "$LOWEST" = "$VERSION" ] && [ "$VERSION" != "$FIXED" ]; then
echo "VULNERABLE — version $VERSION < $FIXED (CVE-2026-12556)"
exit 1
else
echo "PATCHED — version $VERSION >= $FIXED"
exit 0
fiIf you remember one thing.
Sources
What defenders are saying.
Crowdsourced verification outputs.
Results submitted by users who ran the verification payload against their environment.