CVE-2026-15431: CWE-1220 Insufficient granularity of access control in HP Inc. HP Support Assistant

This vulnerability (CVE-2026-15431) in HP Support Assistant is classified under CWE-1220, indicating insufficient granularity of access control. It affects versions prior to 9.53.2.0 and could allow a local attacker with limited privileges to escalate their privileges due to inadequate access control mechanisms. The CVSS 4.0 score is 7.3, reflecting high severity with local attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known exploits are reported in the wild, and no official remediation or patch has been announced by HP Inc. as of the publication date.

The vulnerability could allow a local attacker with limited privileges to escalate their privileges on the affected system. This escalation could lead to unauthorized access to sensitive functions or data within HP Support Assistant, potentially compromising system confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted users only and monitor for any unusual activity related to HP Support Assistant. No official patch or workaround has been provided by HP Inc. at this time.