CVE-2026-63545: Sharp & Toshiba MFP Data Leak Vulnerability

CVE-2026-63545 Overview

CVE-2026-63545 affects Sharp and Toshiba Tec multifunction printers (MFPs). The devices cache print job data internally and fail to clear it after processing. Later users with physical access to the same device may retrieve residual data from previous jobs. The weakness is categorized as [CWE-459] Incomplete Cleanup.

The issue requires physical proximity to the affected MFP and yields low-impact confidentiality exposure. No authentication or user interaction is required to access the cached content. There is no known public exploit, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Residual print data cached on shared MFPs can be accessed by subsequent users, exposing potentially sensitive documents processed earlier by other individuals.

Affected Products

Sharp multifunction printers (see Sharp Security Advisory 2026-004)
Toshiba Tec multifunction printers (see Toshiba Tec Security Update 2026-01)
Refer to vendor advisories for the complete list of affected models and firmware versions

Discovery Timeline

2026-08-03 - CVE-2026-63545 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-63545

Vulnerability Analysis

The vulnerability stems from incomplete cleanup of cached print data on affected Sharp and Toshiba Tec MFPs. When a user submits a print job, the device stores intermediate data in internal storage to render and process the job. After the job completes, the cached artifacts remain on the device instead of being purged.

A subsequent user interacting with the MFP can access this residual data through device functions or maintenance interfaces. The exposure is limited to information that traversed the print pipeline. Because the attack vector is physical, exploitation requires access to the specific device in a shared workspace, print room, or unattended office environment.

Root Cause

The root cause is [CWE-459] Incomplete Cleanup. The firmware processing pipeline does not securely erase temporary print data buffers, spool files, or cached rendered pages after job completion. Storage regions holding those artifacts remain readable across user sessions until overwritten by unrelated activity.

Attack Vector

An actor with physical access to a shared MFP can retrieve cached data from earlier print jobs. Exploitation does not require credentials, network access, or social engineering. Realistic scenarios include walk-up access in office lobbies, mailrooms, print centers, and multi-tenant buildings where MFPs are shared across users or organizations.

Because no exploitation code is required, the vulnerability is described in prose only. See the JVN Vulnerability Report JVNVU98759887 for coordinated disclosure details.

Detection Methods for CVE-2026-63545

Indicators of Compromise

Unexpected reprints or job history entries on shared MFPs that do not correspond to a legitimate user request.
Physical presence of unknown individuals near MFPs outside normal working hours.
Storage or memory utilization on the MFP that remains elevated after all active print jobs complete.

Detection Strategies

Review MFP audit logs and job history for access to cached documents, reprint operations, or maintenance-mode entries by non-administrative accounts.
Correlate physical access logs (badge, camera) with MFP activity to identify unauthorized walk-up interactions.
Enable syslog forwarding from MFPs into a central logging or SIEM platform to retain evidence of job and administrative events.

Monitoring Recommendations

Forward MFP event logs to a centralized log store for retention and correlation with identity and access data.
Alert on maintenance-mode logins, firmware access, and job history exports on shared MFPs.
Periodically inventory MFP firmware versions to confirm devices remain on patched builds.

How to Mitigate CVE-2026-63545

Immediate Actions Required

Apply firmware updates from Sharp and Toshiba Tec as described in the vendor advisories referenced below.
Restrict physical access to shared MFPs, particularly in multi-tenant or publicly accessible spaces.
Enable data overwrite or secure erase features on affected MFPs where supported by firmware.
Require user authentication (PIN, badge, or directory login) before releasing print jobs.

Patch Information

Sharp and Toshiba Tec have published guidance and firmware updates. Refer to Sharp Security Advisory 2026-004, Toshiba Tec Security Update 2026-01, and Toshiba Tec Information Release 2026-01 for model-specific firmware versions and update procedures.

Workarounds

Configure the MFP to purge job data automatically after each print, copy, or scan operation.
Enable pull-printing or secure release so jobs remain on a print server until the user authenticates at the device.
Physically supervise MFPs in high-sensitivity areas until firmware updates are deployed.
Disable device features such as job reprint and stored job retention if not required for business operations.

bash

# Configuration example
# Vendor-specific — consult the Sharp and Toshiba Tec advisories for exact steps.
# Typical hardening actions performed via the MFP web administration console:
#   1. Enable "Data Security Kit" / "Auto Erase" on job completion
#   2. Set job retention period to 0 (do not retain completed jobs)
#   3. Require user authentication for walk-up operations
#   4. Disable reprint of previously spooled jobs
#   5. Update firmware to the version listed in the vendor advisory