Is CVE-2026-26725 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26725 being exploited in the wild.

How severe is CVE-2026-26725?

Critical severity, with a CVSS score of 9.8, published 20 February 2026.

Which products and versions are affected?

edu Business Solutions Print Shop Pro WebDesk 18.34 (fixed in 19.76).

Is there a fix for CVE-2026-26725?

A patch was published on 2026-05-14: Updated description confirms fix in version 19.76 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26725 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-26725?

Check whether you run Edubusinesssolutions Print Shop Pro Webdesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26725: edu Business Solutions Print Shop Pro WebDesk privilege escalation via AccessID

CVE-2026-26725 · Severity: critical · CVSS 9.8 · Published 2026-02-20

A vulnerability in Print Shop Pro WebDesk, a software suite used to manage print shop operations and web-to-print services, allows unauthorized users to grant themselves administrative privileges. By manipulating a specific setting during account registration or profile updates, an attacker can gain full control over the application. This could lead to the exposure of sensitive customer data, disruption of printing services, and unauthorized access to management functions.

Technologies: Edubusinesssolutions Print Shop Pro Webdesk. Vendors: Edubusinesssolutions.

Quick answers

Is CVE-2026-26725 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26725 being exploited in the wild.
How severe is CVE-2026-26725?: Critical severity, with a CVSS score of 9.8, published 20 February 2026.
Which products and versions are affected?: edu Business Solutions Print Shop Pro WebDesk 18.34 (fixed in 19.76).
Is there a fix for CVE-2026-26725?: A patch was published on 2026-05-14: Updated description confirms fix in version 19.76 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26725 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26725?: Check whether you run Edubusinesssolutions Print Shop Pro Webdesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in edu Business Solutions Print Shop Pro WebDesk v.18.34 due to improper privilege management (CWE-269) and a lack of server-side validation on the 'AccessID' parameter. An attacker can self-register an account and then submit a crafted profile update request to the '/PSP/app/web/reg/reg_process.asp' endpoint, setting the 'AccessID' parameter to '1'. Because the application trusts this client-supplied value without verifying the user's current authorization level, the attacker's account is promoted to Super Admin status. This allows for full application takeover and access to administrative functionality at '/PSP/appNet/ManagerHome.aspx'. The issue is resolved in version 19.76.

Affected products

edu Business Solutions Print Shop Pro WebDesk 18.34 (fixed in 19.76)

Timeline

2026-02-20: disclosed: Initial disclosure and CVE assignment
2026-02-20: advisory: NVD publication date
2026-05-14: patched: Updated description confirms fix in version 19.76

References

https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26725

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.