Critical CUPS Vulnerability in Ubuntu 16.04 Allows Code Execution

Linuxsecurity

Critical CUPS Vulnerability in Ubuntu 16.04 Allows Code Execution

First seen 22 Jul 2026, 02:53 UTC • •70.5

Article Content

1 / 3

Browse articles

ThreatCluster •July 23, 2026 at 01:24 UTC

•CUPS vulnerability allows unauthenticated code execution as lp user.
•Affected systems include Ubuntu 16.04 LTS with specific CUPS versions.
•Users should update their systems to mitigate the risk.

A critical vulnerability (CVE-2026) has been identified in the Common UNIX Printing System (CUPS) used in Ubuntu 16.04. The flaw allows unauthenticated attackers to execute arbitrary code as the lp user through specially crafted print job requests. This issue arises from improper filtering of control characters in IPP string attributes and PPD keywords. Systems with shared target queues are particularly at risk. To mitigate the threat, users are advised to update to specific package versions provided in the security notice. The vulnerability affects Ubuntu 16.04 LTS installations with CUPS versions prior to the patched release. A standard system update will apply the necessary changes. The vulnerability highlights the importance of maintaining least privilege access in Linux systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 60d ago How this analysis works

Timeline

2026-07-21

CUPS vulnerability disclosed

CUPS was found to improperly filter control characters, allowing code execution as the lp user.

2026-07-21

Ubuntu Security Notice USN-8578-1 released

Ubuntu issued a security notice detailing the CUPS vulnerability and recommended updates.

Recent

Patch available for affected systems

Users are advised to perform a standard system update to apply necessary patches for CUPS.

More articles in this cluster (2)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Ubuntu

Weakness (1)

CWE-78 - OS Command Injection

Affected Platform (2)

CUPS
Linux

Relationships

Zero-day Exploit targets CUPS
Zero-day Exploit targets Linux
Zero-day Exploit related to Ubuntu
Zero-day Exploit related to CWE-78 - OS Command Injection

Following this threat?

Track Ubuntu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…