HP Support Assistant 9.55.10.0 Fixes Local Privilege Escalation
Tech GuruQuick Answer
HP Support Assistant before 9.55.10.0 has insufficient access controls that can let a local attacker gain privileges. HP's CNA rates CVE-2026-19915 High and identifies low privileges plus an additional attack requirement. Update affected installations to 9.55.10.0 or later; this is not described as an unauthenticated network attack.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory HP Support Assistant versions on managed endpoints, deploy HP's supported update, and confirm the installed version on each device rather than relying only on a successful distribution job.
Last verified: 2026-09-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | HP Support Assistant releases before 9.55.10.0 |
|---|---|
| Advisory | HPSBGN04141 |
| CVE | CVE-2026-19915 |
| CVE record publication | 2026-09-22 14:57:28.834 UTC |
| Recorded CVE revision (historical snapshot) | 2026-09-22 14:57:28.834 UTC |
| Affected versions | HP Support Assistant versions earlier than 9.55.10.0. |
| Fixed version | HP Support Assistant 9.55.10.0 or later |
| CVSS base score | 7.3 (CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The flaw concerns insufficient access controls in HP Support Assistant. The CVSS v4.0 vector specifies local access, low privileges and an additional required condition, but the public CNA does not explain that condition. Do not infer a remote exploit or a particular vulnerable file/service from the score.
What To Validate Now
- Inventory. Locate HP Support Assistant releases before 9.55.10.0 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: HP Support Assistant versions earlier than 9.55.10.0. Do not infer applicability from product family or severity alone.
- Remediate. Apply HP Support Assistant 9.55.10.0 or later through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm version 9.55.10.0 or later on the endpoint and check normal Support Assistant startup and update functions. Record installation failures and devices that remain below the fixed version.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use HP's supported distribution channel and current bulletin for installation requirements. The bulletin returned an access error during this review; HP's own CNA confirms the version boundary and local access-control flaw, but no exploit or endpoint upgrade was tested here.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
