CVE-2026-63563
Received Received - Intake

Authentication Bypass in Sharp and Toshiba MFP Devices

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: JPCERT/CC

Description
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication. Products intended for the Japanese market are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-63563
EUVD
EUVD-2026-52251

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Sharp and Toshiba Tec multifunction printers (MFPs) shipped for certain markets. The user authentication feature is disabled by default, allowing unauthorized access to address book editing and Document Filing features without requiring authentication. Products intended for the Japanese market are not affected.

Detection Guidance

Check if Sharp or Toshiba MFPs in your network have user authentication disabled by default. Verify if address book editing and Document Filing features are accessible without authentication. Inspect device configurations for default settings that allow unauthenticated access.

Impact Analysis

An attacker could exploit this to access sensitive data stored in the address book or Document Filing without authentication. This may lead to data theft, unauthorized document access, or further network compromise depending on the printer's configuration and network setup.

Compliance Impact

This vulnerability could violate compliance requirements that mandate access controls for sensitive data, such as GDPR (data protection) or HIPAA (health information). Unauthorized access risks data breaches, leading to potential legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Enable user authentication on affected MFPs immediately. Restrict access to address book editing and Document Filing features. Update device configurations to enforce authentication for all sensitive operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart