CVE-2026-56809Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability.
Updated under an hour ago ()
Does this affect you?
It affects Ricoh Company, Ltd. Multiple laser printers and MFPs which implement Ricoh Web Image Monitor and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL.
- CVSS
- 5.1 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- jpcert
- NVD analysis
- Deferred
- Record last updated
- Aug 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Ricoh Company, Ltd. Multiple laser printers and MFPs which implement Ricoh Web Image Monitor ricoh:multiple_laser_printers_and_mfps_which_implement_ricoh_web_image_monitor (from the name) | see the information provided by the vendor | CNA record |
Konica Minolta Japan, Inc. Multiple MFPs which implement Ricoh Web Image Monitor konica_minolta_japan:multiple_mfps_which_implement_ricoh_web_image_monitor (from the name) | see the information provided by the vendor | CNA record |
References
- https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2026-000005
- https://jp.ricoh.com/security/products/vulnerabilities/vul?id=ricoh-2026-000005
- https://www.konicaminolta.jp/business/support/important/260831_01_01.html
- https://jvn.jp/en/jp/JVN48718197/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.