Canon patches remote UI flaw in imageRUNNER ADVANCE and imageFORCE printers

Canon issued security advisory CPA2026-003 on April 23, 2026, and updated it June 29, for a vulnerability in the browser-based remote management interface of certain office multifunction and production printers. The flaw, CVE-2026-1789, could let someone with administrator privileges send crafted requests that expose sensitive information stored on the device. Affected lines include imageFORCE, imageRUNNER ADVANCE (including DX models), imagePRESS, imagePRESS Lite, and imageCLASS X. Canon said it had no confirmed reports of exploitation as of the advisory.

The flaw is rated moderate because an attacker needs administrator access first, but that protection is only as strong as the admin password on each device. Copiers and multifunction printers sit on the office network and handle the documents that pass through them, and Canon's own mitigation list starts with changing default passwords and keeping devices off the internet.

Ask your copier dealer or managed print provider to confirm that every affected Canon device has been updated to the fixed firmware listed in the advisory. Canon delivers fixes through automatic updates or its support site, but devices with automatic updates turned off will not get them. While you are at it, ask the provider to confirm that default admin passwords have been changed, that devices are not reachable from the internet, and that administrator and user accounts are separate.

Canon said it may add products to the advisory if more are found to be affected.