Product Security Advisory

The following are details of the vulnerability discovered in relation to the "Affected models and firmware version".

CVE-2026-60011: Unauthorized access to certain functions of the MFP may be possible due to unintended permission settings (CWE-425)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score: 6.9

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score: 5.3

CVE-2026-63545: When attempting to print a specially crafted PDF file from a USB storage device, a different file stored within the MFP may be printed unexpectedly. (CWE-459)

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score: 2.4

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score: 2.4

CVE-2026-63563: Address book can be edited by anyone if the setting for accessing to device web page requires user authentication is not enabled by default (CWE-1188)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.9

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Base Score 6.5

• By a malicious attacker tampering with HTTP requests to the MFP's web interface, it becomes possible to bypass the authentication mechanism and gain access to image data stored on the device.
• A malicious attacker may access the address book of the MFP on which the setting is not enabled by default, potentially causing information leakage.
• A malicious attacker may exploit the multifunction device's direct printing function, potentially causing information leakage or other security incidents.

See "Affected models and the status of countermeasures" below.

Sharp released updated firmware to mitigate these vulnerabilities for the models listed in Table 1.

Regarding the models listed in Table 2, all firmware versions are affected, however, firmware support has ended. Please implement the below mitigation measures or consider discontinuing use of the product or migrating to a successor model.

For details, consult your authorized Sharp service providers.

To mitigate the security risks, ensure to protect your MFPs and apply the following operations:

• Do not connect MFPs directly to the Internet. Connect them via a firewall or similar network appliance.
• Restrict device web page access via password ([System Settings]-[Security Settings]-[Restrict Device Web Page Access Via Password]; this setting is enabled by default).
• Change the default Administrator and the default User passwords from factory default and manage them appropriately.
• Monitor the MFP periodically using the Audit Log functionality to see if suspicious access is observed.

Implementing the above measures can reduce the risk of attacks by malicious third parties that could render the affected MFPs inoperable or result in the disclosure of information stored on the MFPs.

For details, please refer to the following information sources:

[SHARP Support page]
Japan: http://jp.sharp/business/print/information/info_security_2026-07_01.html
Global: http://global.sharp/products/copier/info/info_security_2026-07_01.html

[JPCERT/CC Security Advisory (JVNVU#98759887)]
Multiple vulnerabilities in Sharp and Toshiba Tec MFPs (https://jvn.jp/en/vu/JVNVU98759887/)

The vulnerability CVE-2026-60011 was discovered through a report from Mohamed Abdelhady (Cyber 50 Defense), and CVE-2026-63563 was discovered through a report from John Jackson.

We would like to express our sincere appreciation for the responsible disclosure.

• July 31, 2026: Initial release of this vulnerability information.