Is CVE-2026-39430 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39430 being exploited in the wild.

How severe is CVE-2026-39430?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Hp Poly EagleEye Cube USB 1.3.1-001267.

Is there a fix for CVE-2026-39430?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39430 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39430?

Check whether you run Hp Poly EagleEye Cube USB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39430: HP Poly EagleEye Cube USB authentication bypass in administrator session management

CVE-2026-39430 · Severity: info · Published 2026-11-04

The HP Poly EagleEye Cube USB is a video conferencing camera device used in corporate meeting rooms. An unauthenticated attacker can bypass administrator login and change critical device settings, including exporting configuration files containing administrator credentials and network system secrets. This could allow an attacker to take full control of the device and compromise connected network resources.

Vendors: Hp.

Quick answers

Is CVE-2026-39430 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39430 being exploited in the wild.
How severe is CVE-2026-39430?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Hp Poly EagleEye Cube USB 1.3.1-001267.
Is there a fix for CVE-2026-39430?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39430 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39430?: Check whether you run Hp Poly EagleEye Cube USB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The device fails to enforce session management and access controls server-side for administrator APIs, allowing unauthenticated requests to perform privileged operations. An attacker can bypass the login flow by using a modified client or crafting direct API calls to the management service. This leads to unauthorized access to administrator functions, credential theft, and potential lateral movement into the broader network.

Affected products

HP Poly EagleEye Cube USB 1.3.1-001267

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.