Printers, multifunction printers (MFPs) and the software that runs them handle sensitive information and connect to the systems attackers value most: the corporate directory, email and file shares. Our Ringdale Insights Annual Review sets out what attackers actually did in the twelve months to September 2026, how vulnerabilities in the sector come to light, and what organisations should do about it.
The biggest development was not a printer flaw
It was the compromise of print management servers. Two vulnerabilities in a print management server product were exploited as a zero-day from 26 August 2026, added to the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalogue on 31 August, and used against schools and universities in the US and Europe. With an older flaw in the same product listed in April, all three print-related additions to CISA's catalogue in the year concerned print management software.
As at 28 October 2026, no printer or MFP manufacturer had an entry in the catalogue. Printers were heavily researched, with devices from three manufacturers exploited at the Pwn2Own Ireland contest in October 2025, but none was reported as exploited in the wild. That does not make devices safe: many organisations run printers and MFPs that no longer receive firmware updates, some device flaws cannot be fixed in firmware at all, and disclosure across the sector is uneven.
The year in numbers
- 3 print-related additions to CISA's exploited list in the year, all in print management software
- 0 printer or MFP manufacturer flaws in CISA's exploited list, as at 28 October 2026
- About 157 print-related CVEs published, about 83 of them rated high or critical
- 7 of 23 print management products for which we found no public advisory page or reporting channel
- 13,547 printers reachable from the public internet on 30 September 2026, a third fewer than a year earlier
The Ringdale Threat Radar
The Threat Radar places nine threat categories by how urgently organisations should respond, and shows how each has moved since 2024. Central software compromise and credential abuse now sit at the centre. Cloud, hybrid and mobile printing, supply chain and certificate trust, and emerging AI and post-quantum risks have also moved inwards.
Positions are Ringdale's judgement, based on the evidence in the full report: additions to CISA's exploited list, published CVEs, incident reporting and survey findings from 2024 to 2026.
Five key points
- Print management is now a primary target. An exploited server gave unauthenticated attackers full control, and intruders went looking for the directory credentials it stores.
- Insecure defaults outweigh exotic bugs. Several device advisories concerned authentication switched off by default or services left open, which can be checked when a device is installed.
- Unsupported devices stay vulnerable. Support status is a security control, not an administrative detail.
- Disclosure is uneven. A vendor with few published vulnerabilities is not necessarily more secure than one with many.
- Regulation has started to bite. The EU Cyber Resilience Act's 24-hour vulnerability reporting duty went live on 11 September 2026, and the UK Cyber Security and Resilience Bill is close to completing its passage.
Three years in perspective
Disclosure volume swings with large batches from single sources: Microsoft's print stack in 2023, more than 40 MFP vulnerabilities from one manufacturer in 2024, and about 90 for a single print management product in 2025. Exploitation tells a steadier story. Since the last Windows print spooler addition in April 2024, every print-related addition to CISA's exploited list has been in print management software.
Print-related CVEs and additions to CISA's Known Exploited Vulnerabilities catalogue, twelve months to September. CVE counts are approximate.
Printers on the public internet
The Shadowserver Foundation's daily scans identified 13,547 printers reachable from the public internet on 30 September 2026, about a third fewer than a year earlier, including 3,255 in the US and 260 in the UK. Most are likely to be home, small office or misconfigured systems rather than managed enterprise fleets, and the count includes only devices positively identified as printers, so true exposure is higher.
Daily count on the last day of each month. Each panel has its own scale. Source: The Shadowserver Foundation.
What to do now
A small number of actions reduce most of the risk. The full report sets out the next 90 days and strategic actions, with a device hardening checklist.
- Patch print management servers and print servers first. The only exploited print flaws and the highest severity scores we found were in server software.
- Remove internet and general-network access to administration interfaces on print servers and devices.
- Rotate stored credentials used by print servers and MFPs for the directory, email and file shares, and use least-privilege service accounts.
Read the full report
The full Annual Review runs to 33 pages with more than 90 referenced sources, in UK English (A4) and US English (Letter) editions. It covers the year in review with a register of every verified advisory for July to September 2026, a threat spotlight on print management as identity infrastructure, disclosure practice across 15 printer and MFP manufacturers and 23 print management products, unsupported devices, internet exposure, regulation in the EU, UK, Middle East and US, industry data, the 2027 watchlist and a device hardening checklist.
Declaration of interest. Ringdale develops print management software. It was included in the report's disclosure review on the same basis as every other product and, like any software, can be affected by vulnerabilities.
Key sources: CISA Known Exploited Vulnerabilities catalogue; The Shadowserver Foundation, IoT device statistics; European Commission, Cyber Resilience Act reporting obligations. Full references are in the report. Journalists and researchers can request the report and methodology from insights@ringdale.com.