CVE-2026-8864

HighCVSS 7.3/10Last modified Oct 25, 2026

Description

The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vulnerability.

Metrics

CVSS 4.0 7.3/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-428

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
HP Inc.	HP Fan Control App	< 1.0.0.2

References

https://support.hp.com/us-en/document/ish_15217742-15217770-16/hpsbhf04122

Timeline

Published: Jun 30, 2026
Last modified: Oct 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-886476.5GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (CVE-2026-886483.7In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulner CVE-2026-88656.4The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalon23_qr' shortco CVE-2026-88666.4The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions u CVE-2026-88676.4The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode CVE-2026-88686.4The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions CVE-2026-88696.4The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up t CVE-2026-88706.4The Team Master – A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attribute CVE-2026-887077.1An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters t CVE-2026-887085.3An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, po CVE-2026-887097.0Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to ins CVE-2026-88716.4The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic_link' shortcode in versions up to,