Fedora 44 hplip Update Patches 8 CVEs (CVE-2026-91097 to CVE-2026-91105): Unauthenticated RCE and Privilege Escalation — Detection and Remediation Guide

---
title: HPLIP or CUPS Backend Spawning Shell or Command Interpreter
id: 3f8c2a91-6d4e-4b7a-9c01-2e5f7a8b9d21
status: experimental
description: Detects the hplip hp backend, hpcups filter, or cupsd spawning a shell or scripting interpreter — a strong indicator of exploitation of the print backend for code execution (e.g., CVE-2026-91097/CVE-2026-91105 class flaws).
references:
  - https://linuxsecurity.com/advisories/fedora/hplip-fedora-2026-9e80aed94f
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.exploitation_for_client_execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/hp'
      - '/hpcups'
      - '/cupsd'
      - '/hp-systray'
      - '/hp-toolbox'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate CUPS filter chains invoke interpreters only via defined PPD filter scripts — investigate any occurrence
level: high
---
title: Suspicious Connection to Raw Print Ports Followed by Local Process Execution
id: 9b1e4d62-7a3c-48f5-b2d8-4c6e9f1a2537
status: experimental
description: Detects inbound network connections to JetDirect/raw print ports (9100-9101) accepted by a process that is not the expected cupsd/print service, which may indicate interception or exploitation attempts against the HPLIP network stack.
references:
  - https://linuxsecurity.com/advisories/fedora/hplip-fedora-2026-9e80aed94f
  - https://attack.mitre.org/techniques/T1200/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.initial_access
  - attack.t1200
  - attack.exploitation_of_remote_services
logsource:
  category: network_connection
  product: linux
detection:
  selection_port:
    DestinationPort:
      - 9100
      - 9101
  selection_exclude:
    Image|endswith:
      - '/cupsd'
      - '/cups-browsed'
  condition: selection_port and not selection_exclude
falsepositives:
  - Dedicated print server appliances or alternative print daemons; baseline per host role
level: medium
---
title: Privileged HPLIP Helper Executed by Unprivileged User Context
id: 5d7f2b48-1c9a-4e6d-a3b7-8f2c4d6e9a13
status: experimental
description: Detects execution of HPLIP privileged helper utilities or D-Bus activated hplip services with command lines indicative of privilege abuse, such as file writes to sensitive paths or user/group manipulation — consistent with unauthorized privilege gain via the hplip local attack surface.
references:
  - https://linuxsecurity.com/advisories/fedora/hplip-fedora-2026-9e80aed94f
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|contains:
      - '/hplip/'
      - '/hp-setup'
      - '/hp-plugin'
      - '/hp-check'
  selection_flags:
    CommandLine|contains:
      - '/etc/passwd'
      - '/etc/sudoers'
      - 'chmod u+s'
      - 'setuid'
      - 'cap_setuid'
      - '/root/'
      - 'useradd'
      - 'usermod'
  condition: all of selection_*
falsepositives:
  - Legitimate hp-plugin installation performs some privileged operations; correlate with package manager activity
level: high

// Hunt: child processes spawned by HPLIP/CUPS backend components across the Linux fleet
// Requires Syslog, auditd, or Defender for Endpoint process telemetry in Sentinel
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any ("hp", "hpcups", "cupsd", "hp-systray", "hp-toolbox")
    | where FileName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl", "nc", "ncat", "wget", "curl")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName),
    (Syslog
    | where TimeGenerated > ago(7d)
    | where Facility == "cron" or ProcessName has_any ("cupsd", "hp", "hpcups")
    | where SyslogMessage has_any ("bash", "/bin/sh", "python", "nc ", "wget", "curl")
    | project TimeGenerated, HostName, ProcessName, SyslogMessage)
| order by TimeGenerated desc

// Hunt: network connections to raw print ports from unexpected sources
// Useful for identifying scanning or exploitation attempts against the HPLIP network attack surface
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (9100, 9101)
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP), SourceIPs = make_set(SourceIP, 25) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where DistinctSources > 3 or ConnectionCount > 100
| order by ConnectionCount desc

-- Hunt for suspicious child processes of HPLIP/CUPS components and verify hplip version
-- Deploy as a multi-host hunt across Fedora endpoints

-- Part 1: Process ancestry check
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'bash|/bin/sh|python|perl|nc |ncat|wget|curl'
  AND Username =~ 'lp|root'

-- Part 2: Verify installed hplip version (flag anything below 3.26.6)
SELECT * FROM execve(argv=['rpm', '-q', 'hplip', '--queryformat', '%{NAME}-%{VERSION}-%{RELEASE}\n'])

#!/bin/bash
# hplip CVE remediation & verification script — Fedora 44
# Addresses CVE-2026-91097/098/099/100/101/102/103/105 via hplip 3.26.6

set -euo pipefail

echo "=== Current hplip version ==="
rpm -q hplip || { echo "hplip not installed — no action required"; exit 0; }

CURRENT=$(rpm -q hplip --queryformat '%{VERSION}')
echo "Installed: $CURRENT | Fixed: 3.26.6"

# Apply the security update
echo "=== Applying update ==="
dnf upgrade -y --refresh hplip hplip-common hplip-gui libsane-hpaio

NEW=$(rpm -q hplip --queryformat '%{VERSION}')
echo "Post-update version: $NEW"

# Verify the fixed version is installed
if [[ "$(printf '%s\n' "3.26.6" "$NEW" | sort -V | head -n1)" == "3.26.6" ]]; then
    echo "[PASS] hplip is at or above 3.26.6"
else
    echo "[FAIL] hplip $NEW is still below 3.26.6 — investigate repo mirrors"
    exit 1
fi

# Restart affected services to ensure patched binaries are loaded
echo "=== Restarting print services ==="
systemctl restart cups.service || true

# Hardening: confirm print services are not exposed beyond the LAN needlessly
echo "=== Exposure check: listening print ports ==="
ss -tlnp | grep -E ':(9100|9101|631)' || echo "No raw print ports listening (good)"

echo "=== Quick anomaly check: shells under lp/root spawned recently ==="
journalctl _COMM=cupsd --since "7 days ago" | grep -Ei 'bash|/bin/sh|python|nc |wget|curl' || echo "No suspicious backend child activity in journal"

echo "=== Done. Reboot recommended if hplip libraries are in use by long-running sessions ==="