CVE-2026-63226

MediumCVSS 6.9/10Last modified Oct 24, 2026

Description

Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-923

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-632279.9An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containingCVE-2026-632282.6An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an imagCVE-2026-632299.1A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle viaCVE-2026-632309.1A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database cCVE-2026-632318.1A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the CVE-2026-632329.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment rCVE-2026-632339.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment oCVE-2026-632349.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark CVE-2026-632353.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user giCVE-2026-632363.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifierCVE-2026-632374.8A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a maCVE-2026-632386.5An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator
CVE-2026-63226: Medium severity, CVSS 6.9 | Vulnix