SURIQ
If your office runs a Sharp or Toshiba Tec copier, it may have arrived with the front door propped open. In a coordinated advisory published on 31 July 2026 (JVNVU#98759887), Japan's CERT coordination center disclosed that many Sharp and Toshiba Tec multifunction printers (MFPs, the combined print, scan, and copy machines in most offices) shipped for markets outside Japan with user authentication switched off in the initial configuration. Tracked as CVE-2026-63563, the flaw means that until someone changes that default, anyone who can reach the device on the network can change entries in its address book and browse its Document Filing storage without logging in.
This is not a bug an attacker has to trigger. It is an insecure default (the CVE record classifies it as CWE-1188): the exposure is live the moment the machine is plugged in and left as configured. Devices sold into the Japanese market fall outside the affected set.
What is actually exposed
Two things sit behind that missing login, and both matter more than "it is just a printer" suggests.
The address book is the list of destinations the device sends to: names, email addresses, and often the stored credentials the printer uses to scan to email over SMTP (the standard mail-sending protocol) and to scan to a shared folder over SMB or FTP (common file-sharing protocols). Those are reusable service credentials. Read them, and a printer stops being a printer and becomes a set of keys to a mailbox and a file server.
Document Filing is Sharp's on-device storage for scanned and printed jobs. Unauthenticated access there means reading whatever people scanned and kept: contracts, invoices, identity documents, HR forms. Sharp's own advisory (2026-004) describes the risk as unauthorized access to image data stored on the device and to the address book.
The rating reflects that scope. Both the CVE record and JVN put CVE-2026-63563 at 6.5 under CVSS version 3.1 and 6.9 under version 4.0: reachable across the network, needing no login and no user interaction, with a limited hit to the confidentiality and integrity of data and none to availability. Medium on paper. In practice the number can understate it, because the thing behind the door may include credentials that reach systems the printer never should.
Two companion flaws in the same advisory
The same disclosure carries two more issues worth noting while you are in the device's settings. CVE-2026-60011 lets user authentication be bypassed with crafted web addresses (CVSS 3.1 5.3), so even turning authentication on is not the whole story on unpatched firmware. CVE-2026-63545 is a low-severity flaw (rated 2.4) where the device leaves cached temporary files behind instead of clearing them. Both are addressed by firmware updates rather than a settings change.
Why printers are the node everyone forgets
Printers are the classic blind spot. They are rarely inventoried alongside servers, rarely patched on the same cadence, and they usually sit flat on the same network as the workstations and file servers around them, with a web interface listening the whole time. A default that ships authentication off turns that blind spot into standing exposure, no exploit required, the same way default passwords left on internet-exposed control systems become an open door. The worst case is an MFP whose web interface is reachable from the public internet, where the same missing login is open to anyone who finds it.
What to do this week
For any Sharp or Toshiba Tec MFP outside the Japanese market:
- Find them. Inventory your Sharp and Toshiba Tec MFPs and check whether the device web interface requires a login. If it does not, that is the exposure.
- Turn the setting on now. Enabling the option that requires user authentication for the device web interface is the vendors' immediate workaround for CVE-2026-63563. Do it before anything else.
- Patch what can be patched. Sharp's advisory lists supported models with firmware updates available (its Table 1). Apply them, along with Toshiba Tec's equivalent, to close the two companion flaws.
- Isolate or replace the rest. Sharp lists a second group of models that are past end-of-support with no fix (its Table 2). Those get segmented off or replaced; they will not be patched.
- Rotate the printer's stored credentials. Any scan-to-email or scan-to-folder account whose password sat in an address book on a default-config device should be treated as exposed and rotated.
- Get printers off the flat network. Put MFPs behind an access rule so only print servers and managed hosts can reach their web interface, and confirm none are exposed to the internet.
The detectable part of this is not on the printer itself. If those scan-to-folder or scan-to-email credentials are abused, the signal shows up as unexpected access on the file server or mailbox those credentials open, which is exactly the kind of host a managed detection setup like Suriq watches. Rotate the credentials, then keep an eye on what they could reach.