CVE-2026-63563 describes a vulnerability in Sharp and Toshiba Tec MFPs where the initial device configuration disables user authentication. This insecure default setting permits unauthenticated users to access and modify the address book and use various Document Filing features. The vulnerability is limited to devices outside the Japanese market. There is no vendor advisory or patch information available to confirm remediation status.

An attacker with network access to the affected MFPs can access and modify sensitive address book information and utilize document filing features without authentication. This could lead to unauthorized disclosure and modification of data stored on the device. The CVSS score of 6.5 indicates a medium severity impact with low complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or configuration guidance is provided, users should verify and enable user authentication on affected devices manually to prevent unauthorized access.