{"id":"CVE-2026-91093","kind":"vulnerability","aliases":["CVE-2026-91093"],"related":[],"title":"HP One Agent on HP PCs: privilege escalation and code execution flaw","description":"A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation\n               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.","summary":"HP One Agent, installed on certain HP PC products, has a flaw that may let a local user escalate privileges or run arbitrary code. HP has released software updates to mitigate it.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint","hp","infrastructure","windows"],"not_affected_if":["no-hp-one-agent"],"how_to_check":"- Check the installed HP One Agent version on affected HP PCs against the fixed version listed in HP's bulletin (unknown from these sources)\n- Confirm whether HP One Agent is installed on the machine (unknown from these sources)","fix":"- Install the HP One Agent update from HP as published in HP's security bulletin (exact version unknown from these sources)","status":"open","published_at":"2026-10-23T19:17:45+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:00:13+00:00","updated_at":"2026-10-25T03:00:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:00:13Z","model":"claude-haiku-5-5","output":{"fix":"- Install the HP One Agent update from HP as published in HP's security bulletin (exact version unknown from these sources)","reach":"local","title":"HP One Agent on HP PCs: privilege escalation and code execution flaw","impact":"high","summary":"HP One Agent, installed on certain HP PC products, has a flaw that may let a local user escalate privileges or run arbitrary code. HP has released software updates to mitigate it.","category":"infrastructure","nicknames":[],"who_cares":["hp","windows","endpoint"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user gains elevated privileges or runs arbitrary code","analyst_note":"Find HP's security bulletin for CVE-2026-91093 to get affected product lines, fixed versions and whether the attack needs a local login.","how_to_check":"- Check the installed HP One Agent version on affected HP PCs against the fixed version listed in HP's bulletin (unknown from these sources)\n- Confirm whether HP One Agent is installed on the machine (unknown from these sources)","needs_analyst":true,"not_affected_if":["no-hp-one-agent"],"who_is_affected":"HP PCs with HP One Agent installed, on the product lines named in HP's advisory (unknown from these sources). The sources do not say which product lines or versions are affected, so teams should check whether they run HP One Agent on HP hardware. Teams without HP PCs running this agent can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3291,"output_tokens":541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91093':15A,18A 'agent':3A,25B,64C 'allow':72C 'and/or':77C 'arbitrari':45B,78C 'certain':28B,66C 'code':10A,46B,79C 'cve':13A,16A 'endpoint':19B 'escal':8A,41B,74C 'execut':11A,80C 'flaw':12A,34B 'hp':1A,5A,20B,23B,29B,47B,62C,67C,81C 'identifi':60C 'infrastructur':21B 'instal':26B 'let':37B 'local':39B 'may':36B 'might':71C 'mitig':53B,87C 'one':2A,24B,63C 'pc':30B,68C 'pcs':6A 'potenti':55C,89C 'privileg':7A,42B,76C 'product':31B,69C 'releas':49B,83C 'run':44B 'secur':56C 'softwar':50B,84C 'updat':51B,85C 'user':40B 'vulner':57C,90C 'window':22B","nicknames":[],"mitigations":[],"who_affected":"HP PCs with HP One Agent installed, on the product lines named in HP's advisory (unknown from these sources). The sources do not say which product lines or versions are affected, so teams should check whether they run HP One Agent on HP hardware. Teams without HP PCs running this agent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T19:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"hp-security-alert@hp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91093","severity":null,"published_at":"2026-10-23T19:17:45+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}