Office Printer Security in 2026: Why the Multifunction Printer Is the Least-Patched Computer on Your Network, What Print Spooler and Stored-Credential Flaws Actually Expose, and How to Lock One Down
- Internet Pros Team
- October 12, 2026
- Networking & Security
Ask an IT team which computers they patch every month and you will hear about laptops, servers and phones. The large multifunction printer by the break room rarely comes up. Yet that machine runs a full operating system and a web server. It keeps a hard drive or flash storage full of scanned pages, and it holds passwords that unlock email and file shares. It sits on the same network as everything else, often for seven years or more, and it is usually running the firmware it shipped with.
Why Printers Make Such Good Targets
A modern multifunction printer (MFP) prints, copies, scans, faxes and emails. Each of those jobs needs a network service, and each service is a way in. Attackers like printers for three reasons:
- Nobody watches them. Printers rarely run endpoint protection or send logs to a central system. An attacker who gets a foothold on one can stay for months.
- They hold credentials. Scan-to-email needs an SMTP account. Scan-to-folder needs a Windows (SMB) account. Address books often connect to the company directory (LDAP) with a service account. Those passwords live on the printer.
- They are trusted. Firewalls and desktops are set up to let print traffic through. A printer is a computer that everything on the network agrees to talk to.
The risk is not theoretical. In 2018, a single hobbyist sent a message to roughly 50,000 printers that were reachable from the open internet. No break-in was needed. Their raw printing port was simply open to the world. Search engines that index internet-connected devices still list printers with open admin pages and print ports every day.
A printer is a networked computer with a scanner attached. Treat it like a server, not like a stapler.
The Flaws That Actually Matter
The print path on your computers
Some of the worst printer-related bugs live on the computers that send the jobs, not on the printer. PrintNightmare (CVE-2021-34527) was a flaw in the Windows Print Spooler. It let an attacker run code with system-level rights, including on domain controllers that had no reason to print anything. In 2024, researchers chained several bugs in CUPS, the printing system used by Linux and many Unix-like systems. A machine running the cups-browsed service could be tricked into adding a fake printer. Code could then run as soon as someone printed to it. Both cases teach the same lesson: printing services are often enabled on machines that never print.
The printer itself
On the device, the usual problems are less dramatic but more common:
- Default or shared admin passwords. Many older units ship with a well-known password, or with none at all.
- Raw printing on port 9100. Some models accept printer-language commands on this port. Those commands can change settings or read stored files.
- The LDAP pass-back trick. Someone who reaches the admin page changes the directory server address to a machine they control, then clicks “Test connection”. The printer sends its stored directory password to that machine.
- Stored documents. Job history, mailbox folders and scan caches can keep copies of payroll, contracts and ID documents long after anyone needs them.
- Old firmware. Vendors do publish fixes, but nobody installs them. Unlike a laptop, most printers will not update themselves unless someone turns that on.
Where the Exposure Is and What Closes It
| Exposure | What an attacker gets | What closes it |
|---|---|---|
| Admin web page with default password | Full control: settings, address book, stored credentials | Unique admin password, HTTPS only, admin access limited to the IT subnet |
| Stored SMTP, SMB or LDAP accounts | A working company login, often with far too many rights | Dedicated low-privilege accounts, scan-to-folder limited to one share, LDAPS |
| Legacy services (port 9100, FTP, Telnet, SNMP v1/v2c) | Unauthenticated job submission, settings changes, device fingerprinting | Disable what you do not use; prefer IPPS (printing over TLS) and SNMPv3 |
| Print Spooler or CUPS on machines that never print | Remote code execution on servers and domain controllers | Disable the spooler on servers and domain controllers; remove cups-browsed where unused |
| Internal drive and job history | Copies of scanned and printed documents | Storage encryption, automatic job deletion, a certified wipe at lease return |
What Is Changing in 2026
The good news is that the industry is finally getting rid of the riskiest parts of printing. Driverless printing standards such as IPP Everywhere and Mopria let computers print without installing vendor drivers. Those drivers were a big source of system-level bugs. Windows 11 now offers Windows Protected Print Mode, which allows only the built-in Microsoft driver for modern printers. Microsoft has also announced that it is phasing out support for older third-party printer drivers. On the regulatory side, the EU Cyber Resilience Act requires makers of connected products sold in Europe to report actively exploited vulnerabilities from September 2026. Firmware support is becoming a buying factor, not an afterthought.
Newer business printers also check their own firmware at boot and refuse to run code that has been tampered with. Many ship with a unique admin password printed on a label. If your fleet predates these features, it is worth reviewing which units are now past their supported life.
A Practical Lockdown Checklist
Do these on every printer and MFP
- Inventory first. List every printer, its model, firmware version, IP address and what accounts it stores.
- Set a unique admin password and store it in your password manager, not on a sticky note on the tray.
- Update firmware and turn on automatic or scheduled updates where the vendor supports them.
- Put printers on their own network segment (VLAN). Allow print traffic in from user networks and block everything else, especially outbound internet.
- Never expose a printer to the internet. Check your firewall for forwarded ports 9100, 631, 80 and 443 pointing at a printer.
- Shrink stored credentials. Use dedicated accounts that can only send mail or write to one scan folder.
- Turn on secure release (also called pull printing). Jobs wait until the owner taps a badge or enters a PIN, so payroll does not sit in the tray.
- Disable the Print Spooler on domain controllers and servers that do not print.
- Plan the exit. Before a leased unit goes back, wipe or remove its drive and keep the certificate.
The Bottom Line
Printers are not exciting, which is exactly why they get forgotten. A few hours of inventory, password changes, firmware updates and network segmentation removes most of the risk. Add the printer fleet to the same patch schedule as your servers. Do not buy a device that the vendor will stop updating long before you plan to retire it.
Not sure what your printers are exposing?
Internet Pros audits office networks, segments printers and IoT devices, and sets up secure printing that keeps sensitive documents out of the output tray. Contact our team to schedule a network security review.
