Printers, multifunction printers (MFPs) and the software that runs them handle sensitive information and connect to the systems attackers value most: the corporate directory, email and file shares. Our Ringdale Insights Annual Review sets out what attackers actually did in the twelve months to September 2026, how vulnerabilities in the sector come to light, and what organisations should do about it.
It was the compromise of print management servers. Two vulnerabilities in a print management server product were exploited as a zero-day from 26 August 2026, added to the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalogue on 31 August, and used against schools and universities in the US and Europe. With an older flaw in the same product listed in April, all three print-related additions to CISA's catalogue in the year concerned print management software.
As at 28 October 2026, no printer or MFP manufacturer had an entry in the catalogue. Printers were heavily researched, with devices from three manufacturers exploited at the Pwn2Own Ireland contest in October 2025, but none was reported as exploited in the wild. That does not make devices safe: many organisations run printers and MFPs that no longer receive firmware updates, some device flaws cannot be fixed in firmware at all, and disclosure across the sector is uneven.
The Threat Radar places nine threat categories by how urgently organisations should respond, and shows how each has moved since 2024. Central software compromise and credential abuse now sit at the centre. Cloud, hybrid and mobile printing, supply chain and certificate trust, and emerging AI and post-quantum risks have also moved inwards.
Positions are Ringdale's judgement, based on the evidence in the full report: additions to CISA's exploited list, published CVEs, incident reporting and survey findings from 2024 to 2026.
Disclosure volume swings with large batches from single sources: Microsoft's print stack in 2023, more than 40 MFP vulnerabilities from one manufacturer in 2024, and about 90 for a single print management product in 2025. Exploitation tells a steadier story. Since the last Windows print spooler addition in April 2024, every print-related addition to CISA's exploited list has been in print management software.
Print-related CVEs and additions to CISA's Known Exploited Vulnerabilities catalogue, twelve months to September. CVE counts are approximate.
The Shadowserver Foundation's daily scans identified 13,547 printers reachable from the public internet on 30 September 2026, about a third fewer than a year earlier, including 3,255 in the US and 260 in the UK. Most are likely to be home, small office or misconfigured systems rather than managed enterprise fleets, and the count includes only devices positively identified as printers, so true exposure is higher.
Daily count on the last day of each month. Each panel has its own scale. Source: The Shadowserver Foundation.
A small number of actions reduce most of the risk. The full report sets out the next 90 days and strategic actions, with a device hardening checklist.
The full Annual Review runs to 33 pages with more than 90 referenced sources, in UK English (A4) and US English (Letter) editions. It covers the year in review with a register of every verified advisory for July to September 2026, a threat spotlight on print management as identity infrastructure, disclosure practice across 15 printer and MFP manufacturers and 23 print management products, unsupported devices, internet exposure, regulation in the EU, UK, Middle East and US, industry data, the 2027 watchlist and a device hardening checklist.
Declaration of interest. Ringdale develops print management software. It was included in the report's disclosure review on the same basis as every other product and, like any software, can be affected by vulnerabilities.
Key sources: CISA Known Exploited Vulnerabilities catalogue; The Shadowserver Foundation, IoT device statistics; European Commission, Cyber Resilience Act reporting obligations. Full references are in the report. Journalists and researchers can request the report and methodology from insights@ringdale.com.