CVE-2026-63563: Sharp/Toshiba MFP Auth Bypass Vulnerability

CVE-2026-63563 Overview

Sharp and Toshiba Tec multifunction printers (MFPs) sold outside the Japanese market shipped with the user authentication feature disabled in the initial configuration. Devices left in the default state expose the address book editing interface and multiple Document Filing features to any network-adjacent user. The issue is classified under CWE-1188: Initialization of a Resource with an Insecure Default. Products intended for the Japanese market are not affected.

Critical Impact
Attackers on the same network as an affected MFP can read and modify the address book and access Document Filing functions without providing credentials, exposing stored documents and contact data.

Affected Products

Sharp MFPs (multifunction printers) shipped outside Japan with default configuration
Toshiba Tec MFPs shipped outside Japan with default configuration
Devices where administrators have not enabled user authentication post-installation

Discovery Timeline

2026-08-03 - CVE-2026-63563 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-63563

Vulnerability Analysis

The vulnerability is a default-configuration flaw rather than a code defect. Affected Sharp and Toshiba Tec MFPs ship with the user authentication feature turned off. Administrators who deploy the device without changing the factory setting leave the management interface open to unauthenticated network access. The exposed surface includes address book editing and a range of Document Filing operations, both of which typically require authenticated sessions on hardened MFP deployments.

Address books on enterprise MFPs commonly store internal email addresses, SMB share credentials, LDAP bind information, and fax destinations. Document Filing stores scanned or printed documents on the device for later retrieval. Access to either function without authentication can expose sensitive business data and enable further pivoting against internal file shares or mail systems.

Root Cause

The root cause is an insecure initial configuration. The vendors elected to ship devices in the non-Japanese market with authentication disabled by default, relying on the administrator to enable it during deployment. Devices intended for the Japanese market ship with authentication enabled and are not affected.

Attack Vector

Exploitation requires network reachability to the MFP but no credentials and no user interaction. An attacker on the same network segment as the printer can browse to the management interface or issue API calls to read or modify address book entries and interact with Document Filing features. See the Sharp Security Advisory 2026-004 and JVN Vulnerability Report JVNVU98759887 for vendor-specific technical details.

Detection Methods for CVE-2026-63563

Indicators of Compromise

Address book entries modified, added, or deleted without a corresponding administrator session
Document Filing folders or stored documents accessed or downloaded outside expected business hours
Unauthenticated HTTP or HTTPS requests to the MFP management interface from unexpected internal hosts
Outbound scan-to-email or scan-to-SMB jobs directed at attacker-controlled destinations added to the address book

Detection Strategies

Inventory Sharp and Toshiba Tec MFPs and query each device's authentication setting to identify units still in the default configuration
Monitor MFP web management traffic for successful requests that lack a session cookie or authentication header
Correlate address book change events with authenticated administrator activity in device audit logs
Alert on new address book destinations pointing to external domains or unfamiliar internal shares

Monitoring Recommendations

Forward MFP syslog and audit events to a centralized SIEM and retain them for at least 90 days
Track configuration drift on printer fleets, flagging any device where the authentication flag reverts to disabled
Baseline expected sources of MFP management traffic and alert on deviations

How to Mitigate CVE-2026-63563

Immediate Actions Required

Enable the user authentication feature on every affected Sharp and Toshiba Tec MFP through the device administration console
Change default administrator credentials and enforce role-based access to address book and Document Filing functions
Segment MFPs onto a dedicated VLAN and restrict management interface access to authorized administrative hosts
Audit existing address book entries and stored Document Filing content for unauthorized modifications

Patch Information

This issue is a configuration default rather than a software defect. Sharp and Toshiba Tec have published guidance directing administrators to enable user authentication. Refer to the Sharp Security Advisory 2026-004, the Toshiba Tec News Update July 2026, and the Toshiba Tec Information Announcement July 2026 for model-specific instructions.

Workarounds

Restrict network access to the MFP using firewall or ACL rules that allow only authorized print servers and administrator workstations
Disable unused services such as remote address book editing and Document Filing where they are not required for business operations
Require authentication for all administrative protocols including HTTP, HTTPS, and SNMP write access
Rotate any credentials, SMB shares, or SMTP accounts that were referenced in an address book exposed while authentication was disabled

bash

# Configuration example
# Verify authentication status on an affected MFP (vendor-specific administration console)
# 1. Navigate to: System Settings > User Control > Default Settings
# 2. Set: User Authentication = Enabled
# 3. Set: Authenticate to: Local / LDAP / Active Directory
# 4. Restrict address book and Document Filing to authenticated users only
# 5. Save and reboot the device to apply the new policy