Live vendor data
Toonbank
What leaves support, what driver and firmware level the lanes are on, and which fiscal rule lands next. Every figure is read at the vendor's own page twice a day, and each tab says who checked it and when, so it holds for anyone running tills.
Scope: Epson, Zebra, Datalogic, Opticon, Newland, Honeywell, HP, Bixolon, Citizen, NCR Voyix, Toshiba Tec, Diebold Nixdorf, PAX, Verifone, Ingenico, CCV, Mettler Toledo
76 of 87 figures confirmed at source
Vendor levels checked 2 Nov 2026 at 16:04
Dated deadlines
49 days overdue
CVE-2026-84869, ConnectWise ScreenConnect, is exploited in the wild. CISA due date 14 Sep 2026.
Added to KEV 11 Sep. CVSS 9.9. The client is affected, not the server: fixed in 26.6.5.
41 days overdue
CVE-2026-85880, Windows ALPC, is exploited in the wild. CISA due date 22 Sep 2026.
Local escalation to SYSTEM. Hits LTSC 2016, 2019 and 2021. Fixed in the September updates.
17 days overdue
CVE-2026-96951, Windows Shell, is exploited in the wild. CISA due date 16 Oct 2026.
Security feature bypass over a network, on LTSC 2016, 2019 and 2021. Fixed by the October 2026 cumulative update, KB5126657 on the 19044 lane build. A lane that has not taken the October cumulative update is exposed to something already being exploited.
4 days overdue
CVE-2026-109618 and CVE-2026-109619, PHP2Shell, are exploited in the wild. CISA due date 29 Oct 2026.
Unauthenticated remote code execution in PHP's web request path. Added to the catalogue 26 Oct, forensic triage required under BOD 26-04. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and in HP Device Manager 5.0.18. PHP reaches a store inside things nobody calls a web server: a management console, an appliance admin page, a back office application.
8 days
CVE-2026-111497, the Brotli decoder write, is exploited in the wild. CISA due date 10 Nov 2026.
Unauthenticated out of bounds write, reachable wherever software decompresses an untrusted Brotli stream. Added to the catalogue 27 Oct. Fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, in Node.js 22.23.4, 24.22.1 and 26.12.1, and in the .NET 8 runtime at 8.0.33. .NET Framework is not affected.
today
Greece: mandatory B2B e-invoicing reaches businesses with gross revenue up to EUR 1m on 2 Nov 2026.
Postponed from 1 Oct, announced 30 Sep 2026. Existing accounting or ERP software, or the state apps, may run in parallel to 31 Jan 2027; from 1 Feb 2027 only a provider or the state apps.
8 days
Windows 11 IoT Enterprise, version 23H2, stops receiving updates on 10 Nov 2026.
General Availability Channel, not an LTSC release, so it is the imaging decision rather than the hardware that puts a lane here. 24H2 runs to 12 Oct 2027 and 26H2 to 9 Oct 2029. Confirmed on Microsoft's supported versions of Windows client table.
Checked at source 2 Nov 2026 at 09:30
Windows LTSC runway
Microsoft LifecycleWe verify these against Microsoft's own end of support index pages on learn.microsoft.com (end-of-support-2026, -2027, -2029, -2032 and -2034). All five were read again and every runway date below matches. The two IoT editions each appear twice across those pages, and that is the trap: Windows 10 IoT Enterprise LTSC 2021 is listed at 12 Jan 2027 and again at 13 Jan 2032, and Windows 11 IoT Enterprise LTSC 2024 at 9 Oct 2029 and again at 10 Oct 2034. The earlier date is the end of mainstream support and the later one the end of extended support, which Microsoft's own lifecycle page for LTSC 2021 states as mainstream 13 Jan 2027 and extended 14 Jan 2032. The runway uses the later date, because that is when security updates stop. The shortest way to see the distinction is Microsoft's own supported versions table, which prints the LTSC 2021 extended end as 13 Jan 2032 (IoT Enterprise only) in a single cell, with mainstream end 12 Jan 2027 beside it.
elapsed
remaining
under 6 months
under 2 years
over 2 years
The IoT editions are not the desktop editions. Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 are the same 19044 build, but the IoT SKU carries a 10 year lifecycle and the desktop SKU carries 5. A lane imaged with plain Enterprise LTSC 2021 stops in January 2027. A lane imaged with IoT Enterprise LTSC 2021 keeps receiving security updates to January 2032, but its mainstream support ends in January 2027 too: the second five years are the extended phase, which carries security updates and not the rest. Confirm the SKU per lane before planning either as one migration, and do not read the extended date as five more years of everything.
October servicing, all three Windows 10 LTSC channels
| Channel | Update | Build |
|---|---|---|
| LTSC 2021 / 21H2 | KB5126657 | 19044.7807 |
| 22H2 (non LTSC) | KB5126657 | 19045.7807 |
| LTSC 2019 / 1809 | KB5126651 | 17763.9376 |
| LTSC 2016 / 1607 | KB5126868 | 14393.9612 |
- Released
- 13 Oct 2026. All four builds above carry the fix for CVE-2026-96951, the exploited Windows Shell flaw on the CVE tab. An out of band update did follow, on 26 Oct 2026, and it is a certificate payload rather than a security fix: the row below gives its KB numbers and the open issue below that says who needs it. Microsoft's Windows 10 release information table now gives 26 Oct 2026 as the latest revision for every Windows 10 channel. The 22H2 row appears above only because the October cumulative covers both builds in one KB; 22H2 itself is past end of updates and takes that update under an Extended Security Updates licence, which the KB article states as Applies to: Windows 10 ESU. Builds and KB numbers read from the release information table and from each KB article.
- Out of band
- 26 Oct 2026: KB5134125 (19045.7811 and 19044.7811), KB5134124 (17763.9378) and KB5134123 (14393.9615). All three are non security and carry one change, an updated trusted root certificate payload. Microsoft states who they are for in the same words on each: devices that do not receive current certificate trust list updates, which it gives as disconnected environments, devices that cannot reach its certificate update service, and devices where automatic CTL updates are turned off.
- Last for 1607
- KB5126868 is the final security update for Windows 10 1607. The release health page for that channel states that devices running it no longer receive security updates. The 26 Oct out of band update above does carry a 1607 build, KB5134123 at 14393.9615, and it is not a counter example: it is non security, and its own page is headed Applies to: Windows Server 2016, the edition on the same 14393 build that runs to 12 Jan 2027. Anything else after 13 Oct comes through an Extended Security Updates agreement, and for the IoT edition that is bought from the hardware vendor.
- Next
- Patch Tuesday 10 Nov 2026.
Open known issues
LTSC 2016 left support on 13 Oct 2026 and has had its last update. Extended Security Updates exist, and the IoT edition buys them from the hardware vendor, not from Microsoft.
The 13 Oct release, KB5126868 (14393.9612), is the last security update for this channel, and Microsoft's release health page for 1607 now says in terms that devices running it no longer receive security updates. Microsoft's Windows IT Pro blog Plan for Windows Server 2016 and Windows 10 2016 LTSB end of support, published 20 Feb 2026 and last updated 21 Apr 2026, had confirmed the date for both Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise LTSB 2016, and offers ESU for up to three years beyond it. The two editions are bought through different channels. Enterprise 2016 LTSB ESUs went on sale through Volume Licensing on 1 Apr 2026. ESUs for IoT Enterprise LTSB 2016 are available only through IoT OEMs, so for a lane the route is the device manufacturer, not a Microsoft volume agreement or a reseller quote. Price doubles each consecutive year and the years are cumulative: enrolling in year two means paying for year one as well. ESU carries critical and important security updates only, and explicitly does not extend technical support. Note that Windows Server 2016, which shares the 14393 build, runs on to 12 Jan 2027, so a 14393 figure quoted for the server edition says nothing about a lane. Sources: Windows release health, 1607 channel page; Windows IT Pro blog.
The out of band update of 26 Oct carries root certificates, and it exists for the devices that cannot fetch them for themselves. Segmented lanes
Microsoft shipped KB5134125, KB5134124 and KB5134123 on 26 Oct 2026, one per Windows 10 channel, all non security and all carrying the same single change: an updated trusted root certificate payload. The trigger is on the Advisories tab, the compromise of eight eMudhra intermediate certificate authorities disclosed on 17 Oct 2026. What makes these updates worth a row is who Microsoft says they are for. Windows normally fetches certificate trust list changes, the list of untrusted certificates included, from its own certificate update service, outside the monthly cumulative. Microsoft published these three for the devices that never see that traffic, and names the cases: a disconnected environment, a device that cannot reach the certificate update service, and a device where automatic CTL updates are turned off. A lane on a segmented store network, reaching a patch server and nothing else, is all three at once. So a vendor advisory that says no action is required is making an assumption about connectivity. Zebra's eMudhra alert says exactly that, and qualifies it: no manual remediation for standard, internet connected deployments. A till that is deliberately not one needs the certificate change installed like any other update, through whatever already delivers the cumulative. Sources: the three KB articles, and Microsoft's support article on Secure Boot and certificate expiry.
The one new issue from the October update is an Exchange Server one, and it does not reach a lane. Not a till issue
Microsoft opened 16 Oct 2026, and mitigated the same day, an entry for users being unable to sign in to Outlook Web App or send mail on on premises Exchange Server after the October update. It is listed against KB5126868 (14393.9612) and KB5126651 (17763.9376), which is why it appears on the 1607 and 1809 release health pages that a lane build shares with Windows Server 2016 and 2019. The affected platform list names server editions only, no client edition, and the LTSC 2021 page does not carry it at all. The cause given is the Endpoint Mapper limit of 512 simultaneous endpoint lookup calls, raised by a registry change as a temporary mitigation. Worth knowing because the two channel pages a lane estate watches are shared with the server editions, so an alarming entry on them is not automatically a lane entry. Source: Windows release health, 1607 and 1809 pages.
Remote Desktop Services could stop responding after the September update. Resolved
Opened 11 Sep 2026 against the September update and resolved on 14 Sep by the out of band updates above; the entry was last revised 17 Sep. RDP connections failed after several minutes and machines hung at "Please wait for the Remote Desktop Configuration". The affected list names Windows 10 Enterprise LTSC 2016, LTSC 2019, 21H2 and 22H2 as well as the Server editions. A lane that accepts inbound RDP for support access and took the 8 Sep update is fixed only once it has the out of band one. Read again today, the entry has been retired from all three Windows 10 channel pages, including the LTSC 2021 one it had spread onto, without having been withdrawn. A lane still short of the 14 Sep out of band update is still affected and will no longer find it documented at Microsoft, which is the practical cost of a page that is a current view rather than a record. Source: Windows release health.
USB audio devices may fail to start or give no sound after the September update. Mitigated
Still Mitigated and unchanged at Microsoft: opened 25 Sep 2026, last updated 29 Sep, against the 8 Sep update. The October update did not resolve it and did not change the entry. USB Audio Class 1.0 devices can fail to start with Code 10, give no audio, or leave volume and sound settings unresponsive. The out of band update of 14 Sep fixes only the 8 channel and 3D audio symptom, and Microsoft says it is still working on the rest and points administrators who need the others at support. The affected list names Windows 10 22H2, 21H2, Enterprise LTSC 2019 and LTSC 2016. It matters on a lane only where audio runs through a USB device. Source: Windows release health, all three Windows 10 channel pages.
The LTSC 2021 channel page is down to two entries, and both of the others have dropped off it. Read all three pages
In August this page was last revised 14 Aug 2026 and showed only resolved entries. In early October it carried four: the USB audio one, the Defender notification one, the Remote Desktop Services one, and a Plan9 entry of its own about host folder shares going missing in Hyper-V hosted Linux virtual machines after the September update. On 19 Oct the Plan9 entry had gone. Read again today, the page is revised 30 Oct and still carries two: USB audio, still Mitigated and last updated 29 Sep, and the resolved Defender notification one. Nine days on, a page revision moved nothing a lane reads. The Remote Desktop Services entry has gone from here too, and from the other two channel pages with it. Two things follow for anyone using these pages as a record. An issue can be filed on one channel page and affect another, so all three have to be read rather than the one a lane runs. And a page is a current view, not an archive: entries are retired a few weeks after they resolve, without being withdrawn, so a board item that counts what a page carries has a short shelf life and has to be dated. Source: Windows release health, all three Windows 10 channel pages.
False "Microsoft Defender Antivirus is turned off" notifications. Resolved
Opened 28 Aug 2026 against Defender Antivirus platform 4.18.26070.9, not tied to a Windows KB, and resolved by platform update 4.18.26080.4 of 17 Sep 2026. Microsoft closed the entry on 30 Sep. Defender was running throughout; only the notification was wrong. A lane that still shows the toast is behind on platform updates, which is the same check the three exploited Defender entries on the CVE tab need. Source: Windows release health.
A new Windows 11 IoT Enterprise release shipped, and it is not an LTSC one. Read with care
Windows 11 IoT Enterprise, version 26H2, build 26300, started on 29 Sep 2026 with end of servicing 9 Oct 2029, in the General Availability Channel rather than the Long Term Servicing Channel. Microsoft states that Windows 11 IoT Enterprise LTSC 2024 is still the latest LTSC release, and that new LTSC releases typically come every three years, so nothing on the runway above moves. The reason it matters for a till is the other half of that page: a device on a non LTSC IoT Enterprise build is offered 26H2 through Windows Update, and the GA channel resets a 36 month clock with each annual feature update, so a fixed purpose device on 23H2 leaves support on 10 Nov 2026 while 24H2 runs to 12 Oct 2027. A lane that was imaged with GA channel IoT Enterprise rather than an LTSC SKU is on a treadmill, and that is a licensing decision made once at imaging time. Source: Windows IoT Enterprise release history.
Checked at source 2 Nov 2026 at 16:04
OPOS and UPOS driver levels
42 confirmedWe measure age from the vendor's own published release date. For Newland that date is the file's Last-Modified header, which is an upload stamp rather than a release: three of its drivers carry the same one within three seconds of each other, so read those ages as a site migration and not a shipment.
| Package | Version | Released | Age | Note |
|---|---|---|---|---|
| Epson | ||||
| OPOS ADK | 3.00E R27 | 26 Jun 2025 | 16 mo | Compliant with the Radio Equipment Directive. |
| JavaPOS ADK (Windows) | 1.14.38W | 26 Jun 2025 | 16 mo | Same RED release train as OPOS R27. Epson prints the level as Ver.1.14.38W and the ADK is Windows only, despite what this row used to claim: the Linux ADK is a separate download and is not tracked here. |
| OPOS ADK for .NET | 1.14.37 | 20 Feb 2025 | 20 mo | Signed binaries for Windows 11 Smart App Control. A matching 1.14.38 probably shipped in Jun 2025 but its note could not be surfaced, so this is the last confirmed level. |
| Advanced Printer Driver 6 | 6.10 | 25 Jun 2025 | 16 mo | Versioned per printer model, not globally. 6.10 is the TM-T88VII build; TM-m30III sits at 6.07R1. |
| TM Virtual Port Driver | 8.70c | 22 Aug 2024 | 26 mo | Now a user mode driver, renamed from TMCOMUSB. Separate 8.70b line for TM-S. |
| Epson Monitoring Tool | 3.10.0 | 25 Jul 2025 | 15 mo | Epson's tool for watching printer status on the LAN or on client PCs from an administrator PC, and for saving a printer's settings and restoring them to a replacement. Names the TM-T88VII, TM-T88VI and TM-m30III. Status of a printer on a client PC needs OPOS ADK 3.00, OPOS ADK for .NET 1.11.9, JavaPOS ADK 1.11.9 or Advanced Printer Driver 4.10 or later. This release fixes a vulnerability Epson describes only as an issue related to Windows named pipes, with no CVE given, complies with the EU Radio Equipment Directive and adds Windows Server 2025. The date is the release note's Last-Modified header, as for the other Epson rows; the note itself says uploaded 28 Jul 2025. |
| Epson Deployment Tool | 3.9.0 | 20 Dec 2024 | 22 mo | Epson's tool for installing and setting up many printers and their drivers at once, and for building silent install packages. Names the TM-T88VII, TM-T88VI and TM-m30III. Under a UPOS driver it can set the printer but not the UPOS driver itself. This release added the TM-T20IV, TM-T20IV-SP and TM-T82IV. No newer release note was found, although the Monitoring Tool beside it had a security and Radio Equipment Directive release in Jul 2025. The date is the release note's Last-Modified header; the note itself says uploaded 24 Dec 2024. |
| Zebra | ||||
| Scanner SDK for Windows | 3.07.0014 | 1 Oct 2026 | 1 mo | Installs CoreScanner. This release fixes a CoreScanner service crash when a USB scanner is disconnected while it is still initialising, restores Debug level logging, and adds a query for a Bluetooth cradle's contact health. Zebra Scanner SDK for Windows release notes, 10/2026. |
| OPOS driver, scanner+scale | 3.07.0014 | 1 Oct 2026 | 1 mo | Not independently versioned: it ships inside the SDK InstallShield, so it carries the SDK version. This release's Enhanced OPOS Driver fixes memory leaks from repeated Open and Close cycles on scanner and scale, a scale Claim that succeeded with the device physically disconnected, a scanner left enabled after Open, barcode events delivered after re-attachment with the device disabled, a failed scanner DirectIO command reporting success with the scanner detached, and Power Notify events held back by FreezeEvents. It also adds a DirectIO query for a Bluetooth cradle's contact health. Zebra Scanner SDK for Windows release notes, 10/2026. |
| 123Scan | 6.01.0005 | 1 Oct 2026 | 1 mo | This release adds Bluetooth host type and Bluetooth channel map configuration through the supported plug-ins, and can migrate settings from an existing config file to one for a new scanner model. Zebra 123Scan release notes, 10/2026. |
| JavaPOS driver (Windows) | 3.07.0012 | 1 Jul 2026 | 4 mo | Zebra fixed JPOS Scale behaviour in this release: Device Enable now works without a physical scanner attached, ZeroScale returns success only once the scale truly reaches zero, and Clear Input no longer wipes queued scan data along with pending events. The Scanner SDK has since moved to 3.07.0014 in its 10/2026 release, with no JavaPOS release published alongside it, so the two levels differ again. Zebra techdocs JavaPOS driver release notes, 07/2026. |
| Printer Profile Manager Enterprise | 4.5.8365 | 25 Aug 2026 | 2 mo | End of sale Zebra's server tool for managing Link-OS printers as a fleet: settings, certificates and printer OS updates. Its own release note says end of sale was announced in May 2026, this installer only upgrades an existing installation of v3.4.7711 or later, and the built in trial is to be disabled after end of sale in September 2026. No successor is named. This release adds a Hostname field for printers on Link-OS 7.6 or later, the setting that now decides the printer's DNS name (see the Zebra printer row on the firmware tab), and drops Windows 10 and Server 2019 from its stated requirements without blocking an upgrade on them. Needs Zebra DNA printers on Link-OS 5.0 or later. Zebra release notes, change log entry 25 Aug 2026. |
| Datalogic | ||||
| OPOS drivers | 1.14.211 | 19 Jul 2024 | 27 mo | Confirmed twice, on the download portal and the developer docs site. |
| JavaPOS drivers | 1.14.093 | 14 Jul 2026 | 4 mo | Portal entry of 14 Jul 2026, read from the live page. The developer docs at datalogic.github.io lag the portal, so the dated portal entry wins and the disagreement is noted rather than resolved silently. |
| USB-COM driver | 7.1.5 | 17 Jun 2026 | 5 mo | Certified for Windows 10 and 11, MSI only now that the EXE wrapper is dropped. A legacy 6.3.2 branch from 2018 is still listed for pre Windows 10 images. |
| Aladdin configuration | 3.3.1.8 | 26 Nov 2025 | 11 mo | 64 bit, Windows 8 through 11. |
| DLRMUS | 1.0.28 | 1 Jun 2026 | 5 mo | Remote management suite that updates scanner and scale firmware with no OPOS dependency. Listed here because it is the likeliest public route to Magellan firmware levels, through the model list it bundles. |
| Newland | ||||
| OPOS driver | v120 | 9 Feb 2026 | 9 mo | Newland publishes no version string for this download, so the level is the token in the filename, recorded verbatim rather than reformatted. |
| JavaPOS driver | v1141 | 9 Feb 2026 | 9 mo | Filename token again. Very probably 1.14.1, matching the JavaPOS spec level, but Newland does not print it that way and the digit grouping is not published. |
| UFCOM virtual COM driver | 186 | 9 Feb 2026 | 9 mo | Filename token. The USB virtual COM driver, equivalent to Datalogic USB-COM. |
| EasySet configuration tool | 2.03.006 | 2 Sep 2026 | 2 mo | Version taken from the link label, which Newland does print for this one. |
| Nset configuration tool | 3.01.001 | 12 Mar 2026 | 8 mo | Version taken from the link label. |
| HP | ||||
| Line Display T-Series OPOS | 7.0.3.2 | 4 Jan 2023 | 46 mo | sp144415. The only current generation HP OPOS package: covers Engage Go, One, Flex Pro and Essential on Win10/11 and IoT Enterprise. |
| Cash Drawer Port OPOS | 2.2.2.2 G | 25 Apr 2019 | 90 mo | sp95904. Ageing |
| Receipt Printer OPOS | 1.14.1.12 G | 5 Mar 2018 | 104 mo | sp85623. Ageing |
| USB Cash Drawer OPOS | 1.13.5 | 20 May 2016 | 125 mo | sp75252. Ageing |
| HP Image Assistant | 5.3.7 | 8 Sep 2026 | 2 mo | HP's own tool for analysing an HP system, identifying problems and recommending fixes from HP's SoftPaq catalogue: BIOS, drivers and firmware. HP's supported platform list names every Engage model on the firmware tab, with Windows 10 21H2 LTSC marked supported for the Engage One Pro and Engage One Pro G2. This release improves Extension Driver Support, enhances BIOS credential checks and enables BIOS updates without passwords. SoftPaq sp174326, Windows 10 and 11. HP prints its dates month first. |
| HP Client Management Script Library | 1.9.0 | 18 Aug 2026 | 2 mo | HPCMSL, HP's PowerShell module for BIOS settings, BIOS and firmware updates and SoftPaq queries, published by HP only to the PowerShell Gallery. Its platform list is the same as HP Image Assistant's. The HP rows on the firmware tab are read through it, from HP's SoftPaq reference files, which is also how a scripted fleet check can read an Engage lane's current BIOS when HP's own driver pages need a browser. The date is the gallery's publication date. |
| Bixolon | ||||
| POS Windows driver | V5.2.3 | 18 Aug 2026 | 2 mo | Read from the vendor's own download portal for the SRP-Q300, a current 3 inch POS receipt printer; the identical version and date are published on every current POS printer page checked (SRP-380plus, XD5-40d), so this is one driver level shared across Bixolon's current printer range rather than a per-model figure. |
| OPOS driver | V5.2.10 | 18 Aug 2026 | 2 mo | Same shared driver family as the Windows driver above, confirmed on the same portal pages. |
| JavaPOS driver | V2.8.12 | 18 Aug 2026 | 2 mo | Same shared driver family, confirmed on the same portal pages. |
| Virtual port driver (BXLVCOM4USB) | V2.7.2 | 14 Aug 2026 | 3 mo | USB virtual COM port driver, the same role as Epson's TM Virtual Port Driver and Datalogic's USB-COM driver. Two companion packages published the same day, BXLVCOM4NET (V2.4.5) and BXLVLPT4USB (V1.4.0), are not tracked as separate rows. |
| BIXOLON Utility (Windows) | V1.0.18 | 18 Aug 2026 | 2 mo | Bixolon's configuration utility for its printers, published on the same SRP-Q300 downloads page as the driver rows above, released the same day as the Windows, OPOS and JavaPOS drivers. Separate macOS, iOS and Android versions are published and not tracked here. The same page carries XCM for Windows, V1.1.2 of 14 Aug 2026, under a Management heading. |
| Citizen | ||||
| OPOS driver | V1.14.1.10E | 10 Dec 2025 | 11 mo | Read from Citizen Systems Japan's own download page, a static table whose row for this package names every current model it covers, including CT-S310II, CT-E351, CT-S801III and CT-S851III among others. Windows only. |
| JavaPOS driver | V1.14.0.5E | 20 Dec 2023 | 34 mo | Same download table as the OPOS driver above, covering the same model list plus CT-S310Type1. Two years older than the OPOS driver; both are Citizen's own current published levels, not one lagging a refresh the other already had. |
| POS Printer Utility (Windows) | V21020E | 3 Jul 2025 | 16 mo | Citizen's tool for changing and customising POS printer settings, from Citizen Systems Japan's own utility download table, whose row for it names every current model the driver rows above cover, CT-S310II, CT-E351, CT-S801III and CT-S851III among them. Citizen prints no version for it, so the level is the token in the filename, POSUtility_V21020E.zip, recorded verbatim rather than reformatted, the same convention as the Newland rows. Windows only; Android and iOS versions are store apps. |
| NCR Voyix | ||||
| NCRPSW-Common | 5.1.2.0 | 23 Sep 2026 | 1 mo | NCR Voyix Platform Software for Windows is the package set NCR Voyix files under its OPOS/JavaPOS platform software heading on its own support site, which needs no login. Common is one of three required packages, delivers the shared AERO SDK components and the NcrDeviceAssistant, and needs a Java 17 runtime. The page prints no dates, so the date here is the Last-Modified header of the package's fix list file, an upload stamp rather than a release date, the same convention as the Newland rows. The page lists Windows 11 IoT Enterprise LTSC 2024, Windows 10 IoT Enterprise LTSC 2021 and 2019, and Windows 10 Pro as supported, with a note that support varies by terminal model. |
| NCRPSW-Driver | 5.0.0.7 | 14 May 2026 | 6 mo | Required kernel driver package: edgeport, itl-scs, motherboard, prolific, silabs, libusb, superpro and winusb drivers. NCR Voyix says Driver and Common must be installed before any other NCRPSW package. Date from the fix file's Last-Modified header. |
| NCRPSW-Utility | 5.1.2.0 | 23 Oct 2026 | 0 mo | Required utilities package: the diagnostic tool, third party device integrator, log collector and device configuration tool. This release lists no new features and two fixes: the log collector now gathers Datalogic OPOS logs, which helps on lanes whose Datalogic scanners run under OPOS, and Dr. Watson is removed from the NCRPSW and NCRPSL installers. Date from the fix file's Last-Modified header. NCR Voyix Utility fix list of 16 Oct 2026. |
| NCRPSW-Scanner | 5.4.3.0 | – | NaN mo | The scanner package for POS terminals and self checkout lanes, covering NCR, Datalogic Magellan, Zebra and Honeywell scanners. This release matters most on lanes with Datalogic 9550i or 9600i scanner scales: it adds a Metric Weight Mode setting to the device configuration tool, so metric weighing no longer needs hand edited XML, adds a Datalogic detection plugin that stops needless firmware plugin runs, and fixes Extended Detection Failed on both scales in XPDM. It also fixes EAN-13 items failing in a Walmart Sams card only certification. The page now links a fix list for this package, but no date is collected for it yet. NCR Voyix Scanner fix list of 16 Oct 2026. |
| NCRPSW-POSPrinter | 5.4.1.0 | 23 Sep 2026 | 1 mo | The receipt printer package for POS terminals and self checkout lanes: NCR's own F307 and F309 receipt printers, the F301 and F302 HID receipt printers, the F305, the 7197, 7198 and 7199 series, and the 7167, 7168 and 7169 slip printers. Date from the fix file's Last-Modified header. |
| NCRPSW-Scale | 5.2.0.0 | 6 Jul 2026 | 4 mo | The bag scale package for self checkout lanes, the R5 and R6 NCR Voyix bag scales. Date from the fix file's Last-Modified header. |
Driver age is not evenly spread across this table. Several of the OPOS packages here predate Windows 10 IoT Enterprise LTSC 2021 entirely, and the oldest is over ten years old. That is not automatically a defect, OPOS interfaces are stable and an old driver can be a working driver, but it does mean those peripherals on a fresh LTSC image are running code that was never tested against it. Where a configuration guide pins no version numbers, the per package release notes are the only authority, which is why every row here is dated from one.
Checked at source 2 Nov 2026 at 16:04
Device firmware
11 unverifiedWe read Zebra scanner levels from the quarterly Evolution Update notes, which publish a plug-in build as the firmware level with the scanner build as a component inside it, so we show both. A note only lists what moved that quarter, so each level here is the most recent mention across the last eight notes, and we give the quarter it came from per row. Opticon publishes every model openly. Datalogic and Honeywell publish no firmware on the open web at all.
| Device | Level | Scanner build | Released | What it changes |
|---|---|---|---|---|
| Epson | ||||
| TM-T88VII | 63.08 | – | 23 Jun 2025 | Thai font redesign for Font A/B and Special Font A/B. No bug fixes, no security content. |
| TM-T88VI | 40.61 | – | 24 Sep 2025 | Superseded: Epson's own 26 Jul 2021 announcement for the OmniLink TM-T88VII states it replaces both the TM-T88V and the TM-T88VI. Epson India and Epson Europe now mark it Discontinued: India on its product page (read 16 Oct 2026), Europe on its pages for the 101, 111B1 and 121 EU variants, while its series page carries no notice (read 18 Oct 2026). No end of sale date published. Expect firmware releases to taper. Thai font redesign. Worth knowing: the prior 40.60 added automatic CA signed certificate updates, and enabling that stops the printer entering power saving mode. A separate low speed model line sits at 43.58A. |
| TM-m30III | 13.19 | – | 24 Feb 2026 | Fixes a failure in network communication even with the Wi-Fi LED lit. |
| Zebra | ||||
| MP7000 | PAADGS00-006-R05 | CAADGS00-006-R05 | 5 Mar 2026 | Release 43, from the 2026-Q1 note. End of sale was 15 Sep 2025; service and support run to 15 Dec 2030. Expect firmware releases to taper. |
| MP7200 | PAAFES00-005-R01 | CAAFES00-005-R01 | 21 May 2026 | Release 17, from the 2026-Q2 note. Colour camera bug fix. |
| DS9908 | PAAECS00-007-R00 | CAAECS00-007-R00 | 8 Jun 2026 | Release 23, from the 2026-Q2 note. Adds support for Digimarc Gift Card. |
| DS8108 | PAACZS00-013-R01 | CAACZS00-013-R01 | 10 Apr 2026 | Release 37, from the 2026-Q2 note. Adds Selectable Label Identifier in the Symbologies setting, so a symbology ID can be remapped before transmission to the host, and UDI label parsing for GS1 fields 715 and 716. Superseded: Zebra's DS8208 product page states it replaces the DS8108. No end of sale date is published; expect firmware releases to taper. |
| DS8178 | PAACXS00-013-R01 | CAACXS00-013-R01 | 10 Apr 2026 | Release 48, from the 2026-Q2 note. Same two changes as the DS8108. Cradle firmware is a separate component at CAACYS00-012-R01. Superseded: Zebra's DS8288 product page states it replaces the DS8178. No end of sale date is published; expect firmware releases to taper. |
| DS2208 | PAADES00-009-R00 | CAADES00-009-R00 | 11 Jun 2026 | Release 20, from the 2026-Q2 note. Resolves a rare condition where the previously scanned barcode was sent instead of the current one. |
| DS2278 | PAADFS00-008-R00 | – | 20 Nov 2025 | From the 2025-Q4 note, which lists a plug-in build for this model and no separate scanner component. Shared with the CR2278 cradle. |
| DS4608 | PAAEIS00-004-R00 | CAAEIS00-004-R00 | 23 Jul 2025 | Release 17, from the 2025-Q3 note. |
| LI4278 | PAABIS00-005-R02 | – | 7 Nov 2025 | From the 2025-Q4 note, which lists a plug-in build for this model and no separate scanner component. Shared with the STB4278 cradle. |
| DS9808 | Not verified | – | – | Discontinued Zebra's own DS9800 Series support page states it plainly: Last Sale Date 2 Aug 2019, Service and Support Discontinuation Date 1 Oct 2024, Replacement DS9908 and DS9908r. That support date has already passed. Not mentioned in any of the last eight Evolution Update notes, which fits. No level is claimed here; 123Scan would settle it for a unit still in service. |
| ZD421 / ZD621 Link-OS | V93.21.53Z | – | 25 Sep 2026 | Link-OS 7.7, from Zebra's own cumulative Link-OS release notes. V93 is shared by the ZD411, ZD421, ZD611 and ZD621. 7.7 fixes bugs and validates the DHCP host name strictly: a name with spaces, symbols or accented letters is refused when saved. Link-OS 7.6 (10 Apr 2026) changed what the printer registers in DHCP and DNS: ip.hostname replaced device.friendly_name, which can break printing by name; 7.6.2 copies a valid friendly name across once. 7.6 also turns FTP and HTTP off by default, on a new printer and on an upgraded one whose settings had never been changed. 7.6.2 listed USB enumeration failing on Windows 10 PCs with Intel processors older than the Core i5 7500 series; 7.7 neither lists it nor says it was fixed. Each release is a new PDF under a new name, so this row is hand written. |
| Datalogic | ||||
| Magellan 9400i | DR9401869 | – | – | Discontinued Distributors list it as discontinued and replaced by the Magellan 9600i, which Datalogic describes as a drop-in replacement for the 9300 and 9400; Datalogic's own product page states no status. The download portal carries no Magellan firmware, but the Aladdin configuration repository at aladdin.datalogic.com publishes one configuration per firmware release, and DLRMUS ships firmware payloads carrying the same DR ids. This figure is the newest release published there, which is a release id rather than a version string, and the repository does not carry every release ever shipped. |
| Magellan 9800i | DR9401870 | – | – | Discontinued Distributors list it as discontinued and replaced by the Magellan 9900i; Datalogic's own product page states no status. Firmware releases are published through the Aladdin configuration repository at aladdin.datalogic.com, one configuration per release, and DLRMUS ships firmware payloads carrying the same DR ids. This figure is the newest release published there, which is a release id rather than a version string. Reading it needs no account, and no partner login should be automated. |
| Opticon | ||||
| NLV-1001 | RBCV0155 | – | – | Published openly on the Opticon downloads page, one server rendered table per family, no login. Opticon prints no release date beside the code, so none is claimed here. The collector tracks all 37 current models; the board carries a selection of them. |
| NLV-4001 | TC27J05 | – | – | From the same open downloads table. |
| NLV-5201 | BD52J09 | – | – | Discontinued Opticon's own End of Life Notice, dated 17 Sep 2026, discontinues all four NLV-5201 variants (14265 UD-RS232C(LE), 14309 RS232C(LE), 14483 USB-HID, 14570 HD-USB-COM), the first effective 29 Jun 2026 and the rest immediately, sold until remaining inventory is exhausted. It names a like for like replacement in the NLV-5201S line for each variant. BD52J09 remains the newest release in the open downloads table; no new firmware accompanies the notice. |
| MDI-4700 | BJ01J07 | – | – | From the same open downloads table. |
| MDI-5350 | BK01J01 | – | – | From the same open downloads table. |
| F-70 | TC03J10 | – | – | From the same open downloads table. |
| OPR-2001Z | TM07J09 | – | – | From the same open downloads table. |
| OPR-3201Z | TM07J09 | – | – | From the same open downloads table. |
| OPI-3601 | BA01J39 | – | – | From the same open downloads table. |
| Honeywell | ||||
| Genesis XP 7680g, Stratos, Solaris | Not verified | – | – | First checked on 13 Sep 2026, and the download gate is rechecked weekly, most recently on 30 Oct 2026. Honeywell publishes no scanner firmware or software version on the open web: the product pages carry none at all, and every download route still ends at hsmftp.honeywell.com, which requires a sign in. This one needs an account before it can be collected. The scanner and mobile computing business itself changed hands on 3 Aug 2026, when Honeywell completed the sale of its Productivity Solutions and Services division, these product lines included, to Brady Corporation for $1.4 billion in cash. Honeywell's own support pages still route to hsmftp.honeywell.com rather than to a Brady portal, so the sign in gate is unchanged for now. |
| OPOS and JavaPOS suites | Not verified | – | – | Same gate, now behind Brady's ownership of the business as well as the sign in. Version numbers surface only inside support knowledge articles, which are prose rather than a catalogue, so nothing here is machine readable yet. No collector was written rather than one that could only ever emit empty rows. |
| HP | ||||
| Engage One Pro, BIOS S30 | 2.27.00 | – | 19 Aug 2026 | Security HP rates this release Critical. It addresses CVE-2026-20708, CVE-2026-20715 and CVE-2026-20734, and fixes the on-screen keyboard going missing after Secure Boot is switched on, which a touchscreen lane can depend on. Listed for Windows 10 IoT Enterprise 2021 LTSC. HP SoftPaq sp174265, effective 19 Aug 2026. Patch priority. |
| Engage One Pro G2, BIOS W30 | 2.07.00 | – | 19 Aug 2026 | Security The BIOS for the 15.6, 19.5 and 23.8 inch G2 systems, HP platform 8D09. HP rates this release Critical: the same three CVEs as the S30 release (CVE-2026-20708, CVE-2026-20715 and CVE-2026-20734) and the same on-screen keyboard fix after Secure Boot is switched on. Listed for Windows 10 IoT Enterprise 2021 LTSC. HP SoftPaq sp174264, effective 19 Aug 2026. Patch priority. |
| Engage One Pro G2, driver pack | 1.00 Rev A | – | 9 Dec 2024 | Windows 11 x64 pack covering the 15.6, 19.5 and 23.8 inch G2 systems, 22H2 through 24H2. |
| Engage Go Mobile System, BIOS Q97 | 1.36.00 | – | 6 Aug 2026 | HP platform 846F, the first Engage Go generation. HP Firmware Pack (Q97), SoftPaq sp173875, replacing sp173106, rated Critical by HP. HP's reference files list it for Windows 10 21H2, Windows 11 23H2 and Windows 11 24H2 alike, so one query covers every lane build. The HP collector now reads this platform, after five attempts at HP's own driver pages, which need a browser. HPCMSL Get-SoftpaqList, platform 846F, read 23 Oct 2026. |
| Engage Go 10 and 13.5, BIOS T97 | 1.25.00 | – | 6 Aug 2026 | HP platforms 888C (Engage Go 10) and 8A94 (Engage Go 13.5 inch), one BIOS family for both machines. HP BIOS and System Firmware (T97), SoftPaq sp174010, replacing sp173203, rated Critical by HP. Both platforms return the same SoftPaq, so the collector queries 888C alone and this row stands for both. HP's reference files list it for Windows 10 21H2, Windows 11 23H2 and Windows 11 24H2 alike. HPCMSL Get-SoftpaqList, platforms 888C and 8A94, read 23 Oct 2026. |
| Engage One Essential | Not verified | – | – | HP platform 890D. The S30 SoftPaq explicitly excludes the Essential variant. HP's catalogue knows the platform but serves no SoftPaq reference file for it for Windows 10 21H2 or Windows 11 24H2, and HP Image Assistant's supported platform list does not name it, so neither HP tool on the drivers tab can read this one. Its driver pages are client side rendered and cannot be read without a browser. |
| Value Receipt Printer | Not verified | – | – | Dedicated support pages exist but return no driver rows. The C-Series receipt printer driver (A776, A798, A799, H300) is confirmed at 1.08 Rev B, 11 Feb 2020. |
| Toshiba Tec | ||||
| TCx 900 (4901-x1x), BIOS | 8IKT 2620.1 | – | 11 Aug 2026 | Toshiba Tec's current flagship POS terminal. TCx 900 ships in two hardware generations; this is the earlier 4901-x1x board. BIOS 8IKT 2620.1 with a companion settings utility 0.19, both dated 11 Aug 2026 on Toshiba's own TCx 900 support page. The download itself sits behind a Toshiba Enterprise ID login; the page naming the version does not. |
| TCx 900 (4901-x2x / 4901-x3x), BIOS | 8JKT 2623.0 | – | 24 Sep 2026 | The newer TCx 900 hardware generation. Toshiba's own TCx 900 support page now publishes a BIOS for it, 8JKT 2623.0, with a companion settings utility v0.02, both dated 24 Sep 2026. The download itself sits behind a Toshiba Enterprise ID login; the page naming the version does not. Its OS drivers, a separate set from BIOS, are published openly with no login and were most recently updated 1 Jul 2026 across audio, Bluetooth, chipset, management engine, network, storage, serial and video components, each versioned per component rather than as one pack level, which is why no single figure is carried here. No end of life, end of sale or successor statement appears anywhere on the page for either TCx 900 hardware generation. |
| Diebold Nixdorf | ||||
| BEETLE M2110 | Not verified | – | – | Diebold Nixdorf's current modular POS terminal. The vendor's own product page names Alder Lake and Raptor Lake Intel processor options and lists Windows 10 IoT Enterprise LTSC 2021 and Windows 11 IoT Enterprise LTSC 2024 among its operating systems. No firmware or driver version is published there; the download portals seen (publicdownload, download and dcisdownload subdomains) all sit behind a sign in, the same pattern as Honeywell's hsmftp gate. Deployed across more than 2,350 Rossmann stores in Germany since 2021 and expanding into Switzerland, confirmed by Diebold Nixdorf's own release and separate trade coverage. |
| NCR Voyix | ||||
| CX7 and CX7II (7772), BIOS | R240-06 | – | – | NCR Voyix is the largest self checkout supplier by shipments in Datos Insights' counts, formerly RBR, as reported by Retail Optimiser for 2022 and by NCR Voyix itself for 2024. Since 1 Apr 2026 the hardware is Ennoconn's. NCR Voyix's own 10-Q for the quarter to 31 Mar 2026 states that Ennoconn designs, manufactures, warrants, supplies and ships its self checkout and point of sale hardware, that NCR Voyix sells it as Ennoconn's sales agent and keeps the software, support and maintenance, and that it books commission revenue on that hardware from 1 Apr 2026; the badge on the terminal does not change, the maker and warranty counterparty do. NCR Voyix's open support site, no login, publishes R240-06 as the latest released Windows BIOS for the CX7 family, with checksums and a warning that flashing from a BIOS older than R200-04 wipes the DMI data unless the DMI utility is run first; the page was last modified 21 Sep 2026 and prints no release date. The same site lists the current terminal line as VX80, VX40, CX8, CX7II, CX7, CX5, CX3 and PX10/PX15, and the CX7II supports 64-bit Windows only. |
| SelfServ XK7 (8820-2xxx), BIOS | 9.1.6.1 | – | – | The SelfServ XK7 kiosk's current BIOS on the same support site: release 9.1.6.1 with legacy defaults, 4.1.4.1 with UEFI defaults, both carrying the Intel microcode for the 2019 Microarchitectural Data Sampling flaws. NCR Voyix notes that the operating system image configures itself to whichever BIOS mode it finds, so switching modes after imaging can leave a unit with no boot device. No release date is printed. The SelfServ 90 Rel 2.x (7709-3xxx) self checkout has its own row below; its platform software, the NCRPSW packages on the drivers tab, names both SelfServ 90 versions and the R6, R65 and R7 self checkout lines as supported. |
| SelfServ 90 Rel 2.x (7709-3xxx), BIOS | 9.1.1.2 | – | – | NCR Voyix's open support site links the SelfServ 90 Rel 2.x's BIOS to the RealPOS XR7 Plus (7703) Skylake and Kaby Lake BIOS page, so the unit takes the XR7 Plus board's BIOS. The current release there is 9.1.1.2 with UEFI defaults, for Windows 10 with enhanced security, and 8.1.1.2 with legacy defaults, which NCR Voyix restricts to Skylake units and says must not be flashed on the ten Kaby Lake PIDs it lists. Both carry the Intel microcode for the 2019 Microarchitectural Data Sampling flaws. A unit on an old codebase BIOS, one whose version starts with 1 to 4, needs NCR Voyix's DMI save and write utility before the update, or its DMI data is lost. As on the XK7, the operating system image configures itself to whichever BIOS mode it finds, so switching modes after imaging can leave the unit with no boot device. The page was last modified 21 Sep 2026 and prints no release date, and the files themselves are sent on request. |
| Payment terminals | ||||
| PAX Q80, and the current A-series Android line (A920MAX, A80) | Not verified | – | – | PAX Q80 is registered on the CVE tab (CVE-2026-19908 and three more), with firmware 2.6.33.6690R named only in that disclosure and no fix expected before April 2027. PAX's own product pages name the A920 family (A920MAX, A920 Pro Duo) and the A80 as its current Android generation, confirmed at paxtechnology.com; PAX's own press page names Dojo as deploying the A920MAX in the United Kingdom from June 2026. PAX publishes no open firmware catalogue for any of these models, so no level is claimed here. |
| Engage PCI 4.x fleet (P400, P200, Mx915, Mx925, UX, X10, e355), and Victa | Not verified | – | – | Verifone's own documentation (docs.verifone.com) states a mandatory decommissioning procedure for 'P200 and P400 series PCI PTS version 4.x POI-approved devices', but the page read here did not carry a date. POSDATA Group's distributor end of life table, a US distributor, gives 30 Apr 2026 as End of Support for the PCI 4.x models of the Mx915, Mx925, UX series, X10, e355, P200 and P400, a date that has already passed, and the same figure surfaces independently in search indexing of Verifone's own support content; strong rather than confirmed, since the date itself was not read on a Verifone page directly. The same table names the M400 as the migration for the Mx915 and Mx925, the e280 and e285 for the e355, and the PCI 5.x models of the P200 and P400 for their 4.x predecessors. The M400 is not in the expired fleet: Verifone describes it as PCI 5.x certified. Verifone's own 8 Jan 2026 announcement names Victa as the generation now succeeding Engage, sharing one EMV certification base across the family. No firmware version is published for either generation, so no level is claimed here. |
| Desk/5000, Move/5000 PCI v4/v5 | Not verified | – | – | Ingenico (Worldline)'s own End of Life Notification documents name the Desk/5000 and the Move/5000 PCI v4/v5 (CL1/CL2) terminals. Both are North American notices: the two PDFs are labelled NAR in their own titles, Ingenico's own page for the Desk notice sits on its United States site, and the Desk notice covers only the Desk/3500 and Desk/5000 variants certified to EMV Contactless Level 1 v2.6, not every Desk/5000. The PDFs did not extract as readable text on this box; the dates come from search indexing of the same documents, matched exactly by POSDATA Group's table, a US distributor: Desk/5000 (EMV Contactless Level 1 v2.6) End of Support 30 Jun 2026, already passed, and Move/5000 PCI v4/v5 End of Support 31 Dec 2026, still ahead, with Move/5000 CL3 or Axium DX8000-5 named as the migration. No European or Worldline notice was found, so these dates are not shown to apply to a European estate. Strong rather than confirmed, since neither document was read directly as text. No firmware version is published for either model, so no level is claimed here. |
| VX520, VX820, VX680 | Not verified | – | – | Certification ended CCV's own replacement pages, read directly on both its Netherlands and Belgium sites, say that the VX520, the VX520 with VX820 and the VX680 are certified up to and including 31 Oct 2026 and had to be replaced before then to keep taking payments under the PCI PTS POI rules. That date has passed. Read again on 1 Nov 2026, both pages still give 31 Oct 2026 and name the same three models, and say nothing yet about a terminal still in use after it. When first read on 7 Oct, the same pages named the CCV Duo Base as the replacement. CCV's current countertop and mobile lineup, confirmed on CCV's own product page, is the Compact A77, the Plus Mobile A960 and the Duo Base A80-A35. No firmware version is published for any of them, so no level is claimed here. |
| Scales | ||||
| Mettler Toledo Ariva-B, in Magellan 9550i, 9600i and 9900i | Not verified | – | – | The weighing module Mettler Toledo builds for Datalogic's current bi-optics. Mettler Toledo's own datasheet, dated 05/2025, states a dual interval range of 6 kg/15 kg at 2 g/5 g, RS-232 and USB 2.0, power drawn from the scanner, and OIML, NTEP and CE approvals, and says installation and adjustment are done by certified Mettler Toledo technicians. The same family has Ariva-H for horizontal scanners and Ariva-S as a standalone checkout scale. Datalogic holds its own scale certificate for the 9600i and 9900i, so a lane with either may carry Datalogic's scale or this one, each under a different approval; the field note on scanner scales covers what that means for a firmware rollout. No firmware version is published for the Ariva-B, and Mettler Toledo's product pages refused a plain fetch, so no level is claimed here. |
Checked at source 2 Nov 2026 at 09:30
Peripheral advisories
Vendor security pages we read directly: Zebra, Datalogic, Epson and HP, plus the CISA ICS advisory releases. Datalogic publishes no register at all, so quiet from it is not the same as clear. Zebra's register exists and had published nothing since December 2021 until 21 Oct 2026, which is why it is read rather than assumed. The numbered register is on the CVE tab.
Open, and structural
Networked Epson TM printers execute commands without authentication. No fix
ESC/POS over TCP 9100 has no authentication or encryption by design, so any host that can reach the printer can send it commands, reconfigure it, or read everything it prints. This was assigned CVE-2026-23767 at CVSS 9.8 in March 2026, and JPCERT records that the ESC/POS specification will not be revised, so no firmware fix is coming. The mitigation is network level only. It affects the whole TM line, the TM-T88VI, TM-T88VII and TM-m30 families included. Treat receipt printers as untrusted endpoints on their own segment, not as quiet peripherals.
CVE-2025-66635, command execution in Epson WebConfig. Fixed firmware
An attacker holding the admin password can execute arbitrary commands from a specific WebConfig screen, reset settings, or ping other devices. 26 POS printer models affected. Fixed firmware exists for current generation products. Unique admin passwords, firewall, private addressing. The advisory does not enumerate per model fixed versions.
HP Engage One Pro can hang at a Secure Boot error after a Windows cumulative update. Lane hardware
HP support document ish_9642671-9641393-16 lists the HP Engage One Pro AIO System by name, alongside Engage Flex Pro, Flex Pro-C and Engage Go, among HP commercial products built 2017 to 2023 that use HP Sure Start. After a Microsoft cumulative update from July 2023 onward, a small subset of devices hang or loop continuously on a Secure Boot error screen. HP states the trigger is a system change made by the update but that the issue is not Microsoft's. Fix is a BIOS update; recovery on a stuck device means entering F10 setup and clearing Sure Start Secure Boot Keys Protection, which is hands on the hardware in a public space. Read this next to the Secure Boot certificate expiry item on the CVE tab: different root cause, same failure mode, and October brings both a Patch Tuesday and the 19 Oct certificate date. Read 14 Sep 2026.
One HP bulletin moved for retail this week, and it leaves the first generation Engage One Pro without a published fix. Read by HPSB number
Sorted by update date, one bulletin on HP's index has moved since the last sweep: HPSBHF04085, Intel Graphics Software February 2026 Security Update, which went to Rev. 4 on 28 Oct 2026. Its revision history gives the change as updated version and SoftPaq information for business desktops, point of sale systems and thin clients, and the per row Last Update column says which retail rows it touched: the Engage Flex Mini, Flex Pro, Flex Pro-C, Engage One All-in-One, MP9 G4 and RP9 G1 now read Rev 4, while the Engage One Pro G2 rows still read Rev 1. The row that matters is the one with nothing in it. The first generation HP Engage One Pro AIO System is listed with a minimum version of Pending and no SoftPaq, as is the Engage Go Mobile System, so nine months after the first release of this bulletin HP has published no Intel Graphics fix level for either. It is registered on the CVE tab with every level HP does give.
Nothing else on the index moved. HPSBHF04160, the Critical HP Device Manager bulletin that carries PHP2Shell, is still Rev. 1 of 23 Oct and still fixed in HPDM 5.0.18. HPSBHF04150 is still Rev. 1 of 22 Oct, HPSBHF04158 still Rev. 2 of 20 Oct with its four retail rows unchanged at driver 596.72, HPSBHF04156 still Rev. 3 of 22 Oct with no point of sale section, and HPSBHF04153 still Rev. 1 of 23 Sep. The August Intel firmware work is unchanged: HPSBHF04147 at Rev. 2 of 14 Sep 2026 and HPSBHF04088 at Rev. 5 of 3 Sep 2026. None of these is recorded as clear, because an HP bulletin can grow or fill a point of sale table months after publication, which is exactly what Rev. 4 of HPSBHF04085 just did. Identify a bulletin by its HPSB number and never by its title, because HP runs live bulletins whose titles are identical. All read in a browser, since HP's pages are client rendered and a fetch of one returns nothing at all.
Nothing else on the index moved. HPSBHF04160, the Critical HP Device Manager bulletin that carries PHP2Shell, is still Rev. 1 of 23 Oct and still fixed in HPDM 5.0.18. HPSBHF04150 is still Rev. 1 of 22 Oct, HPSBHF04158 still Rev. 2 of 20 Oct with its four retail rows unchanged at driver 596.72, HPSBHF04156 still Rev. 3 of 22 Oct with no point of sale section, and HPSBHF04153 still Rev. 1 of 23 Sep. The August Intel firmware work is unchanged: HPSBHF04147 at Rev. 2 of 14 Sep 2026 and HPSBHF04088 at Rev. 5 of 3 Sep 2026. None of these is recorded as clear, because an HP bulletin can grow or fill a point of sale table months after publication, which is exactly what Rev. 4 of HPSBHF04085 just did. Identify a bulletin by its HPSB number and never by its title, because HP runs live bulletins whose titles are identical. All read in a browser, since HP's pages are client rendered and a fetch of one returns nothing at all.
Zebra's security alerts page has published twice in a week, after four years and ten months of silence. Channel alive
The LifeGuard security alerts page now carries 15 entries. The newest is Compromise of eMudhra Intermediate Certificate Authorities, dated 27 Oct 2026, and the one before it is PHP2Shell of 21 Oct. Before those two the newest entry was Apache Log4j 2 of 14 Dec 2021. Two publications in seven days settle the question the last sweep opened: this is a live channel, read at every sweep and counted rather than assumed.
What Zebra published is not a defect in a Zebra product. Security researchers disclosed on 17 Oct 2026 that the private keys behind eight eMudhra intermediate certificate authorities were generated with between 3 and 8 bits of entropy, which is little enough that anyone could work the signing keys out and forge a certificate those authorities appear to have issued. Zebra says the reach into its own range is its enterprise Android and Windows lines, and that industrial and desktop printers, fixed RFID readers, machine vision systems and barcode scanners do not use or trust the affected chains at all, which covers most of what sits at a checkout.
The useful half is the condition on the all clear. Zebra says no manual remediation is needed for standard, internet connected deployments, because Google Play Services pushed a blocklist update on 19 Oct and Microsoft updated the Windows disallowed certificate trust list on 20 Oct. For a device that cannot reach those services it then says the opposite: a non GMS device, or one on a restricted network, cannot receive the Google update, and administrators have to disable two roots by hand, emSign ECC Root CA - G3 and the Comodo AAA Certificate Services root that cross signs them, or block the affected chains at the firewall. The Windows half of the same problem is on the Windows tab, where Microsoft published three out of band updates on 26 Oct for devices that never see its certificate update service. Zebra also notes that Chrome and Firefox keep their own root stores, so disabling a root in the Android system store changes nothing for a browser. Source: Zebra LifeGuard security alerts, and the eMudhra alert page itself.
What Zebra published is not a defect in a Zebra product. Security researchers disclosed on 17 Oct 2026 that the private keys behind eight eMudhra intermediate certificate authorities were generated with between 3 and 8 bits of entropy, which is little enough that anyone could work the signing keys out and forge a certificate those authorities appear to have issued. Zebra says the reach into its own range is its enterprise Android and Windows lines, and that industrial and desktop printers, fixed RFID readers, machine vision systems and barcode scanners do not use or trust the affected chains at all, which covers most of what sits at a checkout.
The useful half is the condition on the all clear. Zebra says no manual remediation is needed for standard, internet connected deployments, because Google Play Services pushed a blocklist update on 19 Oct and Microsoft updated the Windows disallowed certificate trust list on 20 Oct. For a device that cannot reach those services it then says the opposite: a non GMS device, or one on a restricted network, cannot receive the Google update, and administrators have to disable two roots by hand, emSign ECC Root CA - G3 and the Comodo AAA Certificate Services root that cross signs them, or block the affected chains at the firewall. The Windows half of the same problem is on the Windows tab, where Microsoft published three out of band updates on 26 Oct for devices that never see its certificate update service. Zebra also notes that Chrome and Firefox keep their own root stores, so disabling a root in the Android system store changes nothing for a browser. Source: Zebra LifeGuard security alerts, and the eMudhra alert page itself.
A new Epson notification names four TM models, and Epson's American and Japanese pages for it disagree. Read the regional page
Epson's notification index has grown to 18 items. The new one is wa00988, Vulnerabilities in Printer and Scanner Root Certificates, CVE-2026-73542: the device carries revoked root certificates, so it can trust a certificate from an untrusted source and a man in the middle can read what it transmits. The affected model lists are collapsed on that page, so a text extract of it reports no models at all; read out of the page markup, the Thermal Printers group names the TM-T20IV, TM-T20IVL, TM-S1000II and TM-S1000II-NW.
Epson's own Japanese announcement for the same CVE names no TM model anywhere, listing inkjet, laser, large format and scanner products only. Both are the vendor's own pages and neither is wrong; each covers the lineup sold in its own market. The practical rule that falls out of it is that the page worth reading is the one for the market a device was bought in, and that a vendor's home country announcement is not the complete affected list. The fix is a Web Config root certificate update to 2.04 or later rather than a firmware level, so it cannot be verified from a version report. Register row on the CVE tab. Sources: epson.com/Support/wa00988, Epson Japan's security announcement of 20 Aug 2026 and JVNVU#91609598.
Epson's own Japanese announcement for the same CVE names no TM model anywhere, listing inkjet, laser, large format and scanner products only. Both are the vendor's own pages and neither is wrong; each covers the lineup sold in its own market. The practical rule that falls out of it is that the page worth reading is the one for the market a device was bought in, and that a vendor's home country announcement is not the complete affected list. The fix is a Web Config root certificate update to 2.04 or later rather than a firmware level, so it cannot be verified from a version report. Register row on the CVE tab. Sources: epson.com/Support/wa00988, Epson Japan's security announcement of 20 Aug 2026 and JVNVU#91609598.
Quiet
No open advisory touches the in counter scanners. Clear
The designated bulletin channel for this scanner line lists nothing referencing scanners, CoreScanner, OPOS or JPOS. Two CoreScanner CVEs exist, CVE-2015-1495 and CVE-2015-1496, both 2015 issues in the superseded Motorola Scanner SDK, still capable of surfacing in a vulnerability scan against a very old install. Note that recent printer advisories for this line reached the public through CISA ICS rather than the vendor bulletin page, so a quiet bulletin page is not the whole picture and the ICS feed is worth watching alongside it.
CVE-2017-6443, XSS in Epson WebConfig. Legacy
Still listed by Epson. Over 40 TM models including TM-T88IV, V and VI. Networked units only, firmware updates available.
Epson, Datalogic and Honeywell unchanged, and no Brotli bulletin from any tracked vendor. Checked
Epson's notification index still carries 18 items and the newest is still wa00988 of August 2026, so nothing has been added since the last sweep. Datalogic publishes no advisory register; its DXU security page, read today, still lists CVE-2021-43333 and nothing else. Honeywell: the two PD45 industrial printer issues of 24 Sep are unchanged and stay on the not applicable table with their fix level. Zebra and HP are covered above.
One upstream flaw was checked against every tracked vendor and found nowhere. CVE-2026-111497, the exploited Brotli decoder write on the CVE tab, is the same shape as PHP2Shell: a compression library embedded in other software rather than a product anyone ships. Zebra's alerts page does not name it, and neither does any recently updated entry on HP's bulletin index. For an upstream component that is a reason to keep asking the question rather than to close it, because PHP2Shell drew a Zebra page and an HP bulletin two days apart. The CISA ICS advisory releases are read daily by a separate job, and the newest advisories are still the three of 29 Oct, all ruled out.
One upstream flaw was checked against every tracked vendor and found nowhere. CVE-2026-111497, the exploited Brotli decoder write on the CVE tab, is the same shape as PHP2Shell: a compression library embedded in other software rather than a product anyone ships. Zebra's alerts page does not name it, and neither does any recently updated entry on HP's bulletin index. For an upstream component that is a reason to keep asking the question rather than to close it, because PHP2Shell drew a Zebra page and an HP bulletin two days apart. The CISA ICS advisory releases are read daily by a separate job, and the newest advisories are still the three of 29 Oct, all ruled out.
Checked at source 2 Nov 2026 at 16:04
CVE register
11 exploitedWe filter for one question: does it reach a checkout lane. Everything here is checked against the CISA exploited catalogue, version 2026.10.30, and we say so when a CVE is not in it, because absence from that catalogue means no confirmed exploitation and that is worth knowing.
Exploited11
Register rows with an exploited CVE that reaches a checkout lane, or the management plane that serves one. Counted by row, so a row grouping several CVEs counts once. Older exploited entries with long standing fixes carry a KEV chip instead and are not counted here.
No fix today6
No patch exists. One will never be fixed, four wait on a vendor until April 2027, one is considered working as designed.
October load1407
Tenable's count of the CVEs Microsoft published on 13 Oct 2026, the largest release to date. Other counts run to 1,415 and the figcaption below names who says what. How many of them list a Windows 10 LTSC build as affected is not counted here: September's figure of 642 came from a product by product read we have not repeated at this size, and a guess would be worse than a gap.
Never researched0
CVEs have ever been published for OPOS, UnifiedPOS or JavaPOS control objects. That is an absence of attention, not an absence of bugs.
The register
| CVE | Lands on | What it gives | State | Fix |
|---|---|---|---|---|
| Act now: exploited, or no fix exists | ||||
| CVE-2026-84869 | ConnectWise ScreenConnect client, every version before 26.6.5 | Files can be transferred to and executed on the Host client system through an active remote session, without authorisation or Host confirmation. The server is not the affected component, the client is, so the exposure runs from a session back toward the machine running support, not only outward to the endpoint. | Exploited KEV 14 Sep 9.9 | ScreenConnect 26.6.5. Published 8 Sep 2026, added to the exploited catalogue 11 Sep with a three day due date. |
| CVE-2026-85880 | Windows ALPC, LTSC 2016, 2019 and 2021 | Heap overflow in the Advanced Local Procedure Call subsystem. Local escalation to SYSTEM, which is the second stage after any foothold on a till. | Exploited KEV 22 Sep 7.8 | September cumulative update |
| CVE-2026-96951 | Windows Shell, LTSC 2016, 2019 and 2021 | Command injection in Windows Shell that lets an unauthorised attacker bypass a security feature over a network. Microsoft rates it Important, with the impact recorded as security feature bypass; the bypass reported is of Mark of the Web, so a file arriving by mail or message opens without the warning that marks it as untrusted. CISA added it to the exploited catalogue on 13 Oct 2026, the day Microsoft shipped the fix, and flagged it for forensic triage. On a till the value of a security feature bypass is quiet persistence rather than a visible break. | Exploited KEV 8.8 | October 2026 cumulative update: KB5126868 (14393.9612), KB5126651 (17763.9376), KB5126657 (19044.7807 and 19045.7807). All four released 13 Oct 2026 and all four require a reboot. CISA due date 16 Oct 2026 has passed, so a lane still on the September update is exposed. Sources: Microsoft Security Update Guide affected product list, which gives the 8.8 base score and the Important rating; CISA exploited catalogue. |
| CVE-2026-33824 | Windows IKE service extensions, LTSC 2016, 2019 and 2021 | Double free in the Windows component that negotiates IPsec, giving an unauthenticated attacker code execution over the network. Microsoft fixed it in April 2026 and CISA added it to the exploited catalogue on 18 Aug 2026, four months later. A lane on any cumulative update from April onward carries the fix; a lane image frozen before April does not, and that is exactly what an exploited listing this late goes looking for. | Exploited KEV 9.8 | April 2026 cumulative update: KB5082198 (14393.9060), KB5082123 (17763.8644), KB5082200 (19044.7184). CISA due date 21 Aug 2026 has passed. Sources: Microsoft Security Update Guide, NVD, CISA exploited catalogue. |
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock, LTSC 2016, 2019 and 2021 | Use after free giving local escalation of privilege. Exploited, so it plays the same role on a till as the ALPC bug above: the second stage after any foothold. | Exploited KEV 7.0 | August 2026 cumulative update: KB5120418 (14393.9418), KB5120238 (17763.9121), KB5120249 (19044.7663). Added to the exploited catalogue 11 Aug 2026, CISA due date 25 Aug has passed. Sources: Microsoft Security Update Guide, NVD, CISA exploited catalogue. |
| CVE-2026-23767 | Every networked Epson TM printer | ESC/POS over TCP 9100 requires no authentication. Anyone with a network path can print, reconfigure, brick the device, or read everything it prints. | No fix ever 9.8 | Segmentation and IP filtering only. JPCERT records that the specification will not be revised. |
| CVE-2025-35970 | Epson TM Web Config, confirmed on TM-T88VI, TM-m50II, TM-H6000V | The initial admin password is the device serial number, and the serial is readable over SNMP with no authentication. | Chain start 8.7 | No firmware fix. Change the password, disable SNMP where unused. Trivial to exploit and trivial to close. |
| CVE-2025-66635 | 35 Epson TM models | Command execution from a Web Config screen. Needs the admin password, which the row above hands over. Treat the pair as one attack path, not two findings. | Chained 8.6 | Fixed firmware available for current generation models |
| CVE-2026-19908<br>CVE-2026-19909<br>CVE-2026-19910<br>CVE-2026-19911 | PAX Q80 payment terminals, firmware 2.6.33.6690R | Unauthenticated root on an adjacent network, and an installer signature verification bypass that defeats the exact control meant to stop unauthorised code reaching a PIN entry device. | No fix 7.1 to 7.5 | None available. Disclosure ran ahead of a fix, and no fixed firmware is expected before April 2027. The only stated mitigation is to restrict interaction with the device. |
| CVE-2025-59287 | WSUS, where the server role is enabled | Unauthenticated remote code execution as SYSTEM through unsafe deserialisation. Does not affect Windows 10 clients, but a compromised WSUS is a direct path to every lane it serves. | Exploited KEV 9.8 | The out of band update of 23 Oct 2025. The 14 Oct patch was incomplete, so confirm which one the server took. |
| CVE-2026-47301 | Microsoft Configuration Manager site server | A four stage chain taking any authenticated domain user to SYSTEM on the site server. Public proof of concept exists. | Public PoC Partly unpatched 2609 shipped | Partial fix in KB 38232642, released June 2026, with the CVE record published 14 Jul 2026; it restores the permission check on the chunked upload path, so an account holding no Configuration Manager role can no longer upload a console extension. The three remaining links, weak code signing validation, a path traversal during cabinet extraction and a DLL loaded without an integrity check, were expected to be closed by Configuration Manager 2609. 2609 has now shipped, reaching the early update ring on 28 Sep 2026 and offered in console to sites on 2503 or later. Its summary of changes names security improvements across multiple components and one specific change, that the site database no longer needs the TRUSTWORTHY property and that Configuration Manager verifies its SQLCLR assemblies are Microsoft signed, but it names no CVE and does not state that this chain is closed. The row stays here until it does. Sources: Microsoft summary of changes for 2609, the KB 38232642 security update page, and the researchers' own write up of the four links. |
| Reaches a lane, and a fix exists | ||||
| CVE-2026-68839 | Windows USB Mass Storage Class Driver, all three builds | Remote code execution. The single most lane specific bug in the September release. | 9.8 | September cumulative update |
| CVE-2026-69768 | Windows RNDIS, all three builds | Remote code execution over USB attached networking, reachable by plugging in a device that presents as a USB network adapter. | 9.8 | September cumulative update |
| CVE-2026-69769 | Windows HTTP Print Provider, all three builds | Remote code execution. One of 11 print spooler and print provider issues this month, none of them exploited. | 9.8 | September cumulative update |
| CVE-2026-69525 | Remote Desktop Services, all three builds | Remote code execution. Matters only where a lane accepts inbound RDP for support access. | Test first 9.8 | September cumulative update, but Microsoft opened a known issue on 11 Sep 2026 for RDS becoming unstable after that same update, with LTSC 2016, 2019 and 21H2 on the affected list. Pilot before a fleet rollout. |
| CVE-2026-69731 | Windows HID Class Driver, all three builds | Local escalation. Relevant because a lane has keyboards, scanners and card readers presenting as HID devices. | 7.8 | September cumulative update |
| CVE-2026-69458<br>CVE-2026-69449 | BitLocker, all three builds | Elevation of privilege. The second, CVE-2026-69449, is a heap overflow that lets a local attacker who already holds high privileges run code. Microsoft labels its impact remote code execution, but NVD gives the attack vector as local, so it does not open a lane to the network. | 8.0 and 6.7 | September cumulative update, for both. Sources: Microsoft Security Update Guide, NVD. |
| CVE-2022-36133 | Epson TM-C3500 and TM-C7500 colour label printers | Web Config authentication bypass with no credentials required. | 9.1 | Firmware update through the Epson business portal |
| CVE-2026-73542 | Epson TM-T20IV, TM-T20IVL, TM-S1000II and TM-S1000II-NW | The device carries revoked root certificates, so it can trust a certificate from an untrusted source and a man in the middle can read what it transmits. Epson reports no attacks exploiting it. No printer on this board is named: the thermal printers Epson lists are the TM-T20IV pair and the TM-S1000II cheque scanner, not the TM-T88 or TM-m30 lines. It is registered anyway because those are lane devices from a vendor we track, and because the remediation leaves nothing behind that a version report can check. | 6.3 v4.0, 3.7 v3.1 | Not a firmware level. Epson's remediation is to open the device's Web Config, run Root Certificate Update and confirm the root certificate reads 2.04 or later, with the business products route going through Network Security and an administrator sign in first. That is one device at a time and it writes no version anybody can audit later, which is the operationally awkward half of this one. JPCERT scores it 6.3 on CVSS 4.0 and 3.7 on CVSS 3.1; Epson publishes no score. Sources: Epson notification wa00988, where the four thermal models are listed, JVNVU#91609598 and the NVD record. |
| CVE-2025-32008<br>CVE-2025-20080<br>CVE-2025-27708 | HP Engage One Pro, through Intel AMT and CSME firmware | Two network denial of service issues and one local read. Inert unless Intel AMT or Standard Manageability is provisioned, which on a typical store lane it is not. | 5.6 to 8.7 | HP bulletin HPSBHF04088, released 10 Feb 2026 and at Rev. 5 as of 3 Sep 2026. Minimum BIOS 02.25.00 (SoftPaq SP170192) for the HP Engage One Pro AIO System, but 02.05.00 (SP170191) for the Engage One Pro 15.6, 19.5 and 23.8 G2 AiO systems, so the fix level depends on which generation a lane carries. Rev. 5 is still the current revision at HP. Both minimums are superseded by the 19 Aug 2026 BIOS releases in the next row. |
| CVE-2026-20715<br>CVE-2026-20708<br>CVE-2026-20734 | HP Engage One Pro, both generations, through Intel AMT and Standard Manageability firmware | A network denial of service and two information disclosures in Intel's manageability firmware. As with the row above, inert unless Intel AMT or Standard Manageability is provisioned, which on a typical store lane it is not. None is in the exploited catalogue. | 5.9 to 8.2 | BIOS 02.27.00 (SoftPaq SP174265) for the HP Engage One Pro AIO System and 02.07.00 (SP174264) for the 15.6, 19.5 and 23.8 G2 AiO systems, both released 19 Aug 2026 and both naming these three CVEs in their release notes. HP's bulletin HPSBHF04147 reached Rev. 2 on 14 Sep 2026 and now carries a retail point of sale table that gives those same two levels, so bulletin and SoftPaq agree; Rev. 1 of 27 Aug had marked the whole category Under investigation. HP scores the three at 8.2, 5.9 and 5.9 on CVSS 4.0. The same Rev. 2 table also names the Engage Flex Mini, Flex Mini G2, Flex Pro, Flex Pro-C, Flex Pro G2, Flex Pro-C G2, Engage Go 10, Engage Go 13.5 and MP9 G4 at their own minimum BIOS levels. Intel advisory INTEL-SA-01427. Sources: HPSBHF04147 Rev. 2, read in a browser. |
| CVE-2025-32092<br>CVE-2025-32453<br>CVE-2025-32739 | HP Engage One Pro and the rest of HP's retail line, through Intel Graphics software | Escalation of privilege and denial of service in Intel Graphics software, which HP rates Medium. All three are local: each needs an account on the device, and the two scored 5.4 also need someone to act, so against a lane running a POS application with nobody signed in interactively these are a second stage rather than a way in. None is in the exploited catalogue. What earns the row is the product table. Rev. 4 of 28 Oct 2026 updated the retail rows, and the first generation HP Engage One Pro AIO System is still listed with a minimum version of Pending and no SoftPaq, as is the Engage Go Mobile System. For those two models no fix level is published, nine months after the bulletin first appeared. | Fix pending, Engage One Pro AIO 5.4 and below | HP bulletin HPSBHF04085, Rev. 4 of 28 Oct 2026. Minimum Intel Graphics versions for the retail line: 32.0.101.7077 (SP165744) for the Engage One Pro 15.6, 19.5 and 23.8 G2 AiO systems and for the Flex Pro G2 and Flex Pro-C G2; 32.0.101.8132 (SP165906) for the Flex Mini G2; 32.0.101.7085 (SP173142) for the Engage Go 10 and the Engage Go 13.5; 31.0.101.2140 for the Flex Mini, Flex Pro, Flex Pro-C and RP9 G1 (SP173554) and for the Engage One All-in-One and the MP9 G4 (SP173770). The Engage One Pro AIO System and the Engage Go Mobile System read Pending. HP scores the three at 5.4, 5.4 and 2.0 on CVSS 4.0, all with a local vector. Intel advisory INTEL-SA-01385. Source: HPSBHF04085 Rev. 4, read in a browser. |
| Management plane and POS software | ||||
| CVE-2026-86218 | N-able N-central before 2026.3.1.14 | Static code injection giving pre-authentication remote code execution on the management server. A change made there propagates to every system the platform manages, which is the whole point of the tool and the whole problem with the bug. | Exploited KEV 9.8 v3.1, 10.0 v4.0 | N-central 2026.3.1.14, shipped as 2026.3 Hotfix 4. KEV due date was 11 Sep 2026 and has passed. |
| CVE-2026-18556<br>CVE-2026-18577 | N-able N-central before 2026.3.1.10 | Authentication bypass giving remote administrative access to the management server without credentials. The second CVE is an incomplete fix for the first. N-able reports that the attacker used Take Control to reach managed devices and registered Cloudflare tunnel services on them, which kept access after N-central access was revoked. Patching the server does not remove a foothold already planted on the endpoints, and for a lane estate the endpoints are the tills. | Exploited KEV 7.4 and 8.1 | Hotfix 2, build 2026.3.1.10, 6 Aug 2026, which N-able says supersedes Hotfix 1 (2026.3.1.7, 2 Aug). N-able's release notes chain Hotfix 4 (2026.3.1.14, the fix above) to Hotfix 3, and Hotfix 3 to Hotfix 2, so an estate at 2026.3.1.14 is past both fixes. The Hotfix 4 notes do not name these two CVEs, so that rests on the supersedence chain rather than a statement from N-able. CISA due dates of 6 and 7 Aug 2026 have passed. Sources: N-able security update of 10 Aug 2026, N-central 2026.3 HF3 and HF4 release notes, NVD. |
| CVE-2026-3564 | ConnectWise ScreenConnect before 26.1 | Per instance machine keys stored in server config could be extracted and reused to authenticate sessions. | Priority 1 9.0 | ScreenConnect 26.1 |
| CVE-2024-1708<br>CVE-2024-1709 | ConnectWise ScreenConnect before 23.9.8 | Path traversal and authentication bypass. Chained and used to deploy Medusa ransomware in April 2026, which is why the older of the two was added to the exploited catalogue two years after disclosure. | Exploited KEV 8.4 and 10.0 | ScreenConnect 23.9.8 |
| CVE-2026-60167<br>CVE-2026-60168<br>CVE-2026-60169<br>CVE-2026-60170 | Oracle Hospitality Simphony 19.8 to 19.10, component POS | Unauthenticated takeover of the application, access to the kiosk administrator console, NTLM hash coercion through the printing handler, and an arbitrary file write to the host. | 7.5 to 8.1 | July 2026 Critical Patch Update |
| CVE-2025-36537 | TeamViewer with Remote Management, before 15.67 | A local unprivileged user deletes arbitrary files as SYSTEM through MSI rollback. Only systems with Backup, Monitoring or Patch Management enabled. | 7.0 | 15.67, or 15.64.5 on the older branch |
| CVE-2026-109618<br>CVE-2026-109619 | PHP, wherever a store or a vendor runs it behind a web interface | Two memory handling flaws in PHP's web request path, together called PHP2Shell, which let an unauthenticated attacker run code on a vulnerable web server. One corrupts request state when PHP runs out of memory; the other lets a long running worker reuse memory an earlier request had freed. The reach into a store is through PHP that nobody thinks of as a web server: a management console, a back office application, an appliance admin page. CISA added both to the exploited catalogue on 26 Oct 2026, with a due date of 29 Oct 2026 that has now passed, and marked them as requiring forensic triage under BOD 26-04; use in a ransomware campaign is listed as unknown. CISA had already called for immediate patching in an alert of 21 Oct 2026. CISA added a second entry on 28 Oct 2026 that completes this chain rather than opening a new one: CVE-2026-46300, a Linux kernel flaw whose catalogue note says it can be chained with these two to implant a PHP webshell and run commands as root. It is local, scored 7.8 on CVSS 3.1, and its due date of 31 Oct 2026 has passed. A till runs Windows, so the kernel is not where this lands; the host serving the PHP interface is, wherever that is a Linux appliance or a back office server. | Exploited KEV 29 Oct 9.2 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all dated 22 Oct 2026 in php.net's own PHP 8 changelog, which lists them as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp and names no CVE id at all; the two php-src advisories, published 21 Oct 2026, carry the CVE ids and both 9.2 scores. The PHP project states that updating is the only complete fix. HP: bulletin HPSBHF04160 Rev. 1 of 23 Oct 2026 rates it Critical for HP Device Manager, fixes it in HPDM 5.0.18, and gives an interim route that patches Apache, PHP and OpenSSL through HTTPSUpgrade.exe on the Configuration Center host. It names no Engage or retail product. Zebra: its customer information page of 22 Oct 2026 states that every service and application it delivers to customers is either already patched or not affected, that it was patching its remaining systems that day, and that it had taken impacted web facing systems offline until the patch was applied. Sources: php.net PHP 8 changelog, the two php-src GitHub advisories, HPSBHF04160, and Zebra's PHP2Shell customer information page. Linux kernel: CVE-2026-46300 is fixed by the eight stable commits NVD lists and ships through each distribution's own updates. The fix carries the shared fragment marker across when paged fragments move between socket buffers, which is what stopped ESP input decrypting in place over page cache backed data. Sources for it: NVD and the kernel stable tree. |
| CVE-2026-111497 | Brotli decompression, versions 1.0.3 to 1.2.0, wherever a store or a vendor decompresses a Brotli stream | An out of bounds write in the Brotli decoder. A malformed stream is reported as needing more input rather than as a format error, so the decoder keeps appending bytes to an eight byte internal buffer; an unauthenticated attacker who can get a crafted stream decompressed can corrupt decoder memory, read process memory, crash the process, or run code. Brotli is a compression library and not a product, so the question for a till is which software decompresses it. Node.js bundles the decoder and anything reaching it through node:zlib is exposed. Microsoft's advisory is the most useful part for POS software, because it says what has to be true first: .NET Framework is not affected at all, and on .NET 8 and later neither ASP.NET Core request decompression nor HttpClient response decompression handles Brotli by default. An application is exposed only if it opts in, by adding the br provider to request decompression, by setting AutomaticDecompression to include Brotli or All, or by calling BrotliStream or BrotliDecoder on data an attacker controls. Installing an affected package is not by itself exposure. CISA added it to the exploited catalogue on 27 Oct 2026, due 10 Nov 2026, with forensic triage not required and ransomware use listed as unknown. | Exploited KEV 10 Nov 9.2 v4.0, 9.8 v3.1 | Brotli 1.0.10, 1.1.1 or 1.2.1, all of 21 Oct 2026; the 1.2.1 release notes name the CVE and describe it as an out of bounds write permitting remote code execution. Node.js 22.23.4, 24.22.1 or 26.12.1 of 21 Oct 2026, which Node.js rates High and which covers the 26.x, 24.x and 22.x lines. .NET: the runtime and NativeAOT packages at 8.0.33 on .NET 8, with a patched package version given per release line for .NET 8, 9, 10 and 11; Microsoft scores it 8.1 on CVSS 3.1 and rates it High. Until an update lands, the mitigation Microsoft gives is to stop passing untrusted Brotli data to those APIs, and it warns against switching request or response decompression on in order to exclude Brotli, because enabling it at all can introduce a denial of service. Google scores the flaw 9.2 on CVSS 4.0 and NVD 9.8 on CVSS 3.1. Sources: NVD, the Brotli 1.2.1 release notes, the Node.js October 2026 security releases, and Microsoft's advisory as dotnet/announcements issue 494. |
| Historic, conditional, or superseded | ||||
| CVE-2026-21510<br>CVE-2026-21513<br>CVE-2026-21519<br>CVE-2026-21525<br>CVE-2026-21533<br>CVE-2026-20805 | Windows Shell, MSHTML, Desktop Window Manager, Remote Access Connection Manager and Remote Desktop Services, LTSC 2016, 2019 and 2021 | Six exploited entries added to the CISA catalogue in January and February 2026, every one of them already fixed by the updates of those same months. Five are local escalation, security feature bypass or denial of service; CVE-2026-21513, in the MSHTML framework, is a security feature bypass reachable over a network that Microsoft scores 8.8. A lane on a current cumulative update carries all six fixes. A lane image frozen earlier carries none of them, and a frozen image is the ordinary state of a till that has been working fine. That is what a catalogue entry of this shape actually tests. | KEV Fixed 2026 | February 2026 cumulative update for the first five: KB5075999 (14393.8868), KB5075904 (17763.8389), KB5075912 (19044.6937). January 2026 for CVE-2026-20805: KB5073722 (14393.8783), KB5073723 (17763.8276), KB5073724 (19044.6809). CISA due dates of 3 Mar and 3 Feb 2026 have passed. Sources: Microsoft Security Update Guide, CISA exploited catalogue. |
| CVE-2026-32202<br>CVE-2023-36424 | Windows Shell and the Common Log File System driver, LTSC 2016, 2019 and 2021 | Two more exploited entries this board did not name. The Shell one is a protection mechanism failure allowing spoofing over a network, which Microsoft scores 4.3; the Common Log File System one is an out of bounds read used to escalate, and that driver has been a repeat target. Both were added to the catalogue in 2026 for fixes that shipped long before. A catalogue entry dated this year can be about a patch from years ago, and it measures how old a lane image is rather than how fast the vendor was. | KEV Fixed | CVE-2026-32202: the April 2026 cumulative update, which Microsoft's guide dates 14 Apr 2026. The guide lists several servicing entries against it and we have not pinned a single build, so no build is given here. CVE-2023-36424: the November 2023 cumulative update, KB5032197 for 1607, KB5032196 for 1809 and KB5032189 for 21H2 and 22H2. CISA due dates of 12 May 2026 and 27 Apr 2026 have passed. Sources: Microsoft Security Update Guide, CISA exploited catalogue. |
| CVE-2026-33825<br>CVE-2026-41091<br>CVE-2026-45498 | Microsoft Defender antimalware platform and malware protection engine, on any lane running Defender | Three exploited entries against Defender itself: an access control weakness that CISA records as used in ransomware, a link following escalation, and a denial of service. Microsoft lists no Windows build as affected for any of the three, because the fix ships in the antimalware platform and the malware protection engine rather than in the monthly cumulative update. That is the part worth carrying: a lane whose Defender platform updates are blocked or pinned, which is common on a tightly held till image, stays exposed through every Patch Tuesday it takes, and a build number check will not show it. | KEV Fixed in the platform | Antimalware platform 4.18.26030.3011 for CVE-2026-33825, malware protection engine 1.1.26040.8 for CVE-2026-41091, antimalware platform 4.18.26040.7 for CVE-2026-45498. CISA due dates of 6 May and 3 Jun 2026 have passed. The check on a lane is the platform and engine version, not the OS build. Sources: Microsoft Security Update Guide, CISA exploited catalogue. |
| CVE-2023-27520 | Epson TM-C3400, TM-C3500 and TM-C7500 colour label printers, through Web Config | Cross site request forgery in the printer's Web Config. An administrator who is signed in and then opens a crafted page has requests made on their behalf, so settings can be changed without the attacker ever holding the password. Same three models as the Web Config authentication bypass already on this register, and it sits on Epson's own notification index, which is the only maintained advisory channel among the peripheral vendors we read. | Needs an admin session 6.5 | Not verified. The advisory is listed but we found no per model fixed firmware version for it. Sources: Epson security notifications index, NVD. |
| CVE-2014-7888 to<br>CVE-2014-7898 | HP OPOS drivers before 1.13.003 | Ten CVEs, remote code execution through the OPOS ActiveX controls. Covers displays, receipt and MICR printers, cash drawers, MSRs, keyboards and scanners. | Fixed 2015 | OPOS driver 1.13.003, SoftPaq SP70564. One inventory query settles this permanently. |
| CVE-2015-1495<br>CVE-2015-1496 | Motorola Scanner SDK, the CoreScanner ancestor | A remote buffer overflow and a local escalation through weak file permissions on CoreScanner.exe. | Superseded | The Zebra 3.x SDK line. Only relevant where legacy Motorola branded middleware survives. |
| CVE-2023-4957 | Zebra ZT410 and GK420d printers | Authentication bypass from the adjacent network when protected mode is off. | Discontinued hardware | Link-OS 6.0 protected mode. Both models went end of sale in 2020 and 2022 and support ended in 2025, so this reads as a lifecycle finding more than a vulnerability. |
| CVE-2017-6443 | Epson Web Config across 40 or so TM models | Cross site scripting. Needs an administrator to follow a crafted link. | Fixed firmware | Firmware versions 1.02 to 4.44 depending on model |
| CVE-2021-43333 | Datalogic DXU on rugged mobile computers | The DXU service requires no authentication to read or change configuration. In store relevant for DL-Axist and Skorpio handhelds, not for fixed lane scanners. | Config 6.5 | No fixed version published. Disable DXU. Off by default on current Skorpio X5. |
| CVE-2024-43468 | Microsoft Configuration Manager 2303, 2309 and 2403 | SQL injection giving an unauthenticated attacker remote code execution on the site server and its database. Disclosed in 2024, added to the exploited catalogue on 12 Feb 2026. | KEV Fixed 2024 9.8 | Hotfix KB29166583, October 2024, which Microsoft lists for 2303, 2309 and 2403. NVD's product list names 2403, 2409 and 2503 instead, so the two sources disagree on reach and we have not resolved that. Sources: Microsoft Security Update Guide, NVD. |
| CVE-2025-8875<br>CVE-2025-8876 | N-able N-central before 2025.3.1 | Insecure deserialisation and OS command injection, both needing an authenticated user. Added to the exploited catalogue on 13 Aug 2025. | KEV Fixed 2025 7.8 and 8.8 | N-central 2025.3.1, released 13 Aug 2025. Any build on the 2026.3 line above is later. Sources: N-able status page, NVD. |
| CVE-2019-18988 | TeamViewer Desktop through 14.7.1965 | Bypass of remote login access control, because the same key protected stored passwords on every customer's installation. Added to the exploited catalogue in Nov 2021. | KEV Fixed 2020 7.0 | Windows 14.7.39531, 16 Apr 2020, per TeamViewer's change log. Fixed levels for other major versions were not verified. Sources: TeamViewer community change log, NVD. |
October 2026 Patch Tuesday, by type
October broke the record September set, and the counting problem got worse with it. Published totals disagree: Tenable says 1,407, BleepingComputer 1,411, CrowdStrike and The Cyber Express 1,413, and ZDI's own count 1,415. Critical counts disagree the same way, 69 at Tenable, 70 at BleepingComputer, 75 at CrowdStrike, and that is Microsoft's own severity rating, not CVSS. The type breakdown above is BleepingComputer's, whose three largest categories match CrowdStrike's exactly; its six categories sum to 1,389, short of every published total, so read the bars as the shape of the release rather than a complete partition of it. One CVE in the release is exploited, CVE-2026-96951, and two more were publicly disclosed before the release without being exploited: a .NET Framework security feature bypass and a MessagePack-CSharp denial of service, neither of which reaches a lane as shipped.
The USB and HID cluster in the September release
22 USB and 2 HID vulnerabilities in the September release. Estate specific
Led by CVE-2026-68839, USB Mass Storage Class Driver remote code execution at CVSS 9.8 on all three LTSC builds, and CVE-2026-69768, RNDIS remote code execution at 9.8, which is reachable by plugging in a device that presents itself as a USB network adapter. None are currently exploited. We have not repeated this count for the October release, which is three times the size.
This is the attack surface a checkout lane has and an office desktop does not: a physically reachable machine in a public space with live USB ports and a scanner, a scale, a card reader and a cash drawer hanging off them. Patching is the fix, but USB device installation policy, allowlisting by hardware ID, is the control that holds between patch cycles.
This is the attack surface a checkout lane has and an office desktop does not: a physically reachable machine in a public space with live USB ports and a scanner, a scale, a card reader and a cash drawer hanging off them. Patching is the fix, but USB device installation policy, allowlisting by hardware ID, is the control that holds between patch cycles.
Dated, and not a CVE
Secure Boot certificate expiry: the last 2011 certificate expired on 19 Oct 2026. Firmware level
The Microsoft KEK CA 2011 expired on 24 Jun 2026, the UEFI CA 2011 on 27 Jun 2026, and the Windows Production PCA 2011, which signs the Windows boot loader, on 19 Oct 2026. All three have now passed, and Microsoft's page shows no postponement. Enterprise and IoT Enterprise LTSC 2019 and 2021 are all explicitly named as affected. A device still on the 2011 certificates keeps starting and keeps installing standard Windows updates, so nothing on the lane looks wrong; what stops is new early boot protection: Boot Manager updates, DB and revocation list updates, and boot level mitigations. Read again today, Microsoft's own page is more nuanced than this board was. Most devices receive the 2023 certificates automatically through Microsoft managed updates, and the October cumulative says that deployment through Windows Update is still going out to the devices its targeting data judges ready; an organisation managed device follows Microsoft's certificate update guidance instead. What is not automatic is the part that depends on the hardware: Microsoft says some devices need an OEM firmware update before the certificates apply correctly, and that such an update may only be available for a device still inside its support period. Fixed function retail hardware is exactly the category where both halves of that bite. Microsoft also says plainly that Secure Boot should not be turned off to work around the expiry, because that removes the boot level protection rather than restoring it. Microsoft's page also applies to Windows 10 version 1607, all editions, which takes in LTSC 2016, although that release left support on 13 Oct 2026. Source: Microsoft support article on Secure Boot certificate expiration.
Deployment tooling holds credentials in lane memory. By design
VU#164934. PDQ Deploy's Deploy User run mode places credentials in the active memory of the target device during a deployment, where they can be extracted and reused to move laterally across domain joined systems. No CVE was assigned and no patch is planned, the behaviour being treated as inherent to Windows authentication rather than a product defect. The recommended controls are Windows LAPS, least privilege, avoiding domain admin credentials, and the Logged on User run mode.
Worth sitting with: a lane is a domain joined machine standing in a public space, which makes it the least physically secure one on the network it belongs to, and the deployment tool routinely hands it credentials that work fleet wide.
Worth sitting with: a lane is a domain joined machine standing in a public space, which makes it the least physically secure one on the network it belongs to, and the deployment tool routinely hands it credentials that work fleet wide.
Where this register is blind
Four categories where an empty result means nobody looked.
OPOS, UnifiedPOS and JavaPOS control objects have never had a CVE. They are unsigned COM objects registered machine wide and loaded in process by the POS application on every lane, which is a textbook hijack surface. No advisory stream exists to subscribe to.
Payment terminal firmware largely sits outside the CVE system. It is patched through PCI PTS certified channels instead, so the public record structurally understates the category. A sweep across the major terminal lines for 2024 to 2026 returns almost nothing, and that is a property of the disclosure route rather than a clean bill of health.
A maintained advisory feed does not exist for every line on this board. For most of the peripheral lines here there is no security feed to subscribe to, and one publishes BIOS CVEs inside per package release notes rather than on a product security page. Where that is the case NVD and CISA ICS have to be watched directly, and a bulletin page with nothing recent on it cannot be read as an absence of issues.
Retail POS software is thinly covered. A sweep across the major retail POS suites returns no 2025 or 2026 CVEs at all, and several carry a single record going back a decade. Given how much of this software runs on a lane, that is far likelier to describe how little of it is researched than how few bugs it holds.
Payment terminal firmware largely sits outside the CVE system. It is patched through PCI PTS certified channels instead, so the public record structurally understates the category. A sweep across the major terminal lines for 2024 to 2026 returns almost nothing, and that is a property of the disclosure route rather than a clean bill of health.
A maintained advisory feed does not exist for every line on this board. For most of the peripheral lines here there is no security feed to subscribe to, and one publishes BIOS CVEs inside per package release notes rather than on a product security page. Where that is the case NVD and CISA ICS have to be watched directly, and a bulletin page with nothing recent on it cannot be read as an absence of issues.
Retail POS software is thinly covered. A sweep across the major retail POS suites returns no 2025 or 2026 CVEs at all, and several carry a single record going back a decade. Given how much of this software runs on a lane, that is far likelier to describe how little of it is researched than how few bugs it holds.
Checked and not applicable here
| CVE | Why it does not apply |
|---|---|
| CVE-2026-81963 | The other September zero day, in the Windows Update stack, and also exploited. It lists only Windows 11 and Server 2025 as affected. It does not reach a Windows 10 LTSC lane. |
| CVE-2026-42016<br>CVE-2026-42018<br>CVE-2026-67277<br>CVE-2026-86060<br>CVE-2026-19490<br>CVE-2026-20079<br>CVE-2026-85706<br>CVE-2026-75650 | The rest of the exploited catalogue additions in the week to 11 Sep 2026: JFrog Artifactory, MikroTik RouterOS, Citrix NetScaler, Cisco Firewall Management Center, GitLab and Adobe Commerce. All are real and several are network edge or build chain issues worth someone's attention, but none is a lane, a peripheral, a payment terminal or the tooling that deploys to them. Listed here so the same week is not re-triaged next run. |
| CVE-2026-73542 | Epson retained revoked root certificates. The affected list runs to 266 models, all inkjet, laser, scanner and large format. No TM series, no UB interface boards. |
| CVE-2025-64310 | Epson, no rate limiting on authentication. Projector products only. |
| CVE-2025-42598 | Epson Windows driver local escalation in non English environments. Epson's affected list names the Universal Printer Driver and consumer lines; no POS driver is listed, though absence from a list is not the same as confirmed unaffected. |
| CVE-2019-13526 | Datalogic AV7000. An industrial conveyor and parcel scanner, not a lane scanner. |
| CVE-2026-58315<br>CVE-2024-47295<br>CVE-2023-23572 | Epson Web Config issues whose affected model tables cover consumer and office print lines only. No POS models listed. |
| CVE-2008-4250<br>CVE-2008-0015<br>CVE-2009-1537<br>CVE-2010-0249<br>CVE-2010-0806 | Five Microsoft entries CISA back filled into the catalogue on 17 Feb and 20 May 2026. The catalogue dates are new, the bugs are not: the Server Service overflow behind Conficker, the Video ActiveX control, a DirectShow QuickTime parser and two Internet Explorer use after frees. NVD lists none of the five against any Windows 10 build, and the newest affected system named in any of them is Windows 7. A recent catalogue date is not evidence that something reaches a current lane. |
| CVE-2025-60710 | Exploited, and CISA records it as used in ransomware, but Microsoft's Security Update Guide names only Windows 11 24H2 and 25H2 and Windows Server 2025. No Windows 10 build appears, so it does not reach an LTSC lane. |
| CVE-2026-42897 | Filed in the catalogue under the bare product name Microsoft, which is why a product filter walks past it. It is an Exchange Server cross site scripting issue in Outlook Web Access. Not lane software. |
| CVE-2026-20917<br>CVE-2026-20760 | Two Intel firmware issues HP published in September 2026, both local, neither critical. HPSBHF04153 has no retail point of sale section at all. HPSBHF04146 gained one at Rev. 2 on 24 Sep 2026, and it names a single retail system, the Engage Flex Mini G2 at BIOS 02.06.00 (SP174288). The Engage One Pro is not listed in either. |
| CVE-2025-35973<br>CVE-2026-20713<br>CVE-2026-20901 | Three more Intel firmware issues from HP bulletins read this week. HPSBHF04145, which shares its title exactly with HPSBHF04146, gained a retail point of sale table at Rev. 2 on 17 Sep 2026 and names only the Engage Flex Mini G2 at BIOS 02.06.00 (SP174288); CVE-2025-35973 is local, 4.5. HPSBHF04156 of 1 Oct 2026 covers Intel Xeon processor firmware and has no point of sale section. The Engage One Pro is in none of them. Recorded as ruled out rather than as clear, because a point of sale table here has twice appeared weeks after a bulletin was published. |
| CVE-2026-13248<br>CVE-2026-13249 | Honeywell PD45 industrial printer, published 24 Sep 2026. The second is unauthenticated remote code execution through the printer's web management interface at CVSS 9.8, the first an authenticated arbitrary file write through the Intermec Fingerprint command interface at 8.8. Both affect firmware F10.19.010040 and are fixed in F10.22.030745. The PD45 is a back of house industrial label printer, not a lane peripheral, and this board carries no PD45 row, so it sits outside the register's filter the same way the Datalogic AV7000 conveyor scanner does. The fix level is recorded here because an estate that runs one for shelf edge or warehouse labels needs it, and because an unauthenticated web interface on a networked printer is the same shape as the Epson Web Config entries that are on the register. |
| CVE-2018-5550<br>CVE-2020-6091<br>CVE-2020-9014<br>CVE-2020-9453 | The last untriaged items on Epson's security notification index, read this week so the index is now accounted for end to end. CVE-2018-5550 is cross site scripting in the AirPrint web configuration page and its affected list is 59 ET, WF and XP series inkjets with no TM model on it; CVE-2020-6091 is a projector Web Control authentication bypass; CVE-2020-9014 and CVE-2020-9453 are iProjection display driver issues. None reaches a POS printer or a POS driver. |
| CVE-2015-6034 | Also on Epson's index, and ruled out on a different basis from the rest, which is worth saying plainly. It is a privilege escalation in the EPSON Network utility on Windows, fixed in 2015 by replacing that utility, and Epson's advisory names no affected models at all. So it is not ruled out on a model list: it is ruled out because the component is a desktop network configuration utility rather than any part of the POS printer driver stack. An estate that has that utility installed on a lane should treat it as in scope. |
Checked at source 23 Oct 2026 at 14:17
GS1 Sunrise 2027
Scanner and hostAmbition 2027 globally, Sunrise 2027 in the US, QR Code powered by GS1 in the Netherlands. We read these from gs1.org, gs1us.org and gs1.nl: the end of 2027 date has not moved, and every document below is at the version shown.
424days to 31 Dec 2027
What it actually says, and where it does not agree with itself
All retail POS systems should be able to read and process a defined set of 2D barcodes by the end of 2027, alongside existing linear barcodes. Read that sentence carefully: the burden sits on the read side, not the print side. The lanes carry it. Suppliers carry nothing, and for brand owners the transition is explicitly optional, so supplier pressure will not set the pace.
GS1 global calls it a goal; GS1 US calls it a milestone and adds that "it is not necessary to implement all the capabilities of 2D by that date". Checked on gs1.nl 14 Sep 2026: GS1 Nederland does not use the word verplichting. Its published wording is a commitment, "Retailers committeren zich aan helder doel: eind 2027 zijn hun systemen gereed om de QR Code powered by GS1 te scannen", and Albert Heijn, Jumbo, Kruidvat, HEMA and others are listed as having committed. An earlier version of this board quoted an obligation wording that does not appear on GS1 Nederland's site. The distinction matters commercially: a Dutch retailer can point at a public commitment it has made, which is a different conversation from a rule it is obliged to meet.
What the scanner has to do
- Decode all three retail 2D types: GS1 DataMatrix, QR Code carrying a GS1 Digital Link URI, and Data Matrix carrying a Digital Link URI.
- Handle normal and reversed reflectance.
- Decode in under 300 ms on a bioptic, under 500 ms on presentation and activated handheld.
- Support scanning modes 1, 2 and 3.
- Let the retailer configure which data is transmitted.
EAN and UPC are not being switched off. Dual marked packs are expected right through the transition, which is why the co-located barcode cases matter more than the plain 2D read.
What the POS host has to do
- Parse both GS1 element string syntax and GS1 Digital Link URI syntax.
- Accept a 14 digit GTIN (09506000134352, not only 9506000134352) and store it normalised.
- Identify the right item when linear and 2D sit on the same pack, with one beep, not two.
- Process optional AIs: expiry 17, batch or lot 10, serial 21, weight.
- Act on them: expiry stop sale, batch recall blocking, date driven markdown.
- Persist everything received for backend use.
This is the half that is genuinely engineering work. The likely failure is not a no read: the scanner decodes fine and hands the host a Digital Link URI or a 14 digit GTIN, and the host returns item not found.
Fleet position
| Question | Answer | Detail |
|---|---|---|
| Imager or laser | Hard line | 2D at POS needs an image based scanner. No firmware rescues a laser, there is no image to process. Any remaining laser lane is a replacement, not an upgrade. Audit this first, it is the only part with a capex tail. |
| Zebra MP7000 | Vendor documents handling | Multiple CMOS array imager. Decodes Aztec, DataMatrix, MicroPDF417, MicroQR, PDF417, QR and Han Xin, with integrated Digimarc support. Zebra's own MP72 Scanner Scale Barcode Programming Guide, which covers this model and the MP7200 also on this board, carries a GS1 Digital Link Parameters section with the same three modes as the rest of the line, configured through 123Scan. 123Scan's own release notes date GS1 Digital Link configuration support to version 6.00.0021 (Aug 2024) and programming support for supported scanners to 6.00.0028 (Dec 2024). A reseller's rollout list separately dates this model's firmware wave to April 2025; the vendor's own guide now confirms the feature exists, where before only the reseller list did. Remember the MP7000 is end of sale since 15 Sep 2025. |
| Zebra DS8108 and DS8178 | Vendor documents handling | Standard range 2D imagers, corded (DS8108) and cordless (DS8178). Zebra's own Product Reference Guide for the DS8108 (MN-002926-11EN) carries a GS1 Digital Link Parameters section with GS1 Digital Link Mode and GS1 Digital Link Prioritization Timeout entries, and Zebra's Data Parsing on Zebra Scanners guide names the DS8178 directly alongside it. Both are configured through 123Scan. A reseller's rollout list dates the DS81x8 firmware wave to 16 Apr 2025; the DS8108 already carries Selectable Label Identifier and UDI parsing for GS1 fields 715 and 716 from the same firmware generation, recorded on the firmware tab. No conformance test result against the Ambition 2027 criteria is published for either model. |
| Zebra DS2208 and DS2278 | Vendor documents handling | Entry level DS2200 series imagers, corded (DS2208) and cordless (DS2278), reading both 1D and 2D codes. The DS2278 Product Reference Guide (MN-002915-18EN) documents GS1 Digital Link, GS1 Digital Link Mode and GS1 Digital Link Prioritization Timeout; the DS2208 shares the same guide and parameter set. A reseller's rollout list dates this pair, and the APAC only DS1000, to 5 Sep 2025. No conformance test result against the Ambition 2027 criteria is published. |
| Zebra DS4608 | Vendor documents handling | On counter 2D imager. Zebra's Data Parsing on Zebra Scanners guide and the DS4608 Product Reference Guide (MN-003378-08EN) both name it among the scanners carrying the GS1 Digital Link decoder and its three scanning modes. A reseller's rollout list dates the DS46x8 firmware wave to 28 Jul 2025. No conformance test result against the Ambition 2027 criteria is published. |
| Zebra DS9908 | Vendor documents handling | Hybrid handheld and hands free 2D imager. Zebra's Data Parsing on Zebra Scanners guide names it directly as carrying the GS1 Digital Link decoder, with the same three modes as the rest of the line, configured through 123Scan. A reseller's rollout list dates the firmware wave to 6 Jun 2025. No conformance test result against the Ambition 2027 criteria is published. |
| Zebra DS9308 | Vendor documents handling | Presentation 2D imager. Zebra's own DS9308 Product Reference Guide (MN-003532-08EN, Oct 2025) added GS1 Digital Link Parameters and GS1 Retail Parsing in that revision: an enable setting, GS1 Digital Link Mode with the same three modes as the rest of the line, and a Prioritization Timeout that defaults to 200 ms. The guide names no minimum firmware. A part number trap: the DS9308-DL configurations are driver's licence parsing models, and DL there has nothing to do with Digital Link. No conformance test result against the Ambition 2027 criteria is published. |
| Zebra DS3608 and DS3678 | SR and HP only | Rugged 2D imagers, corded (DS3608) and cordless (DS3678). Zebra's own DS36X8 Product Reference Guide (MN-002689-22EN, Oct 2025) added GS1 Digital Link Parameters and GS1 Retail Parsing in that revision, with the same three modes, but states that the feature applies only to the DS36x8-SR and DS36x8-HP configurations, and that Mode 3 does not apply to the DS3678-HP with keypad and display. Any other DS36x8 configuration has no Digital Link statement, so check the configuration on the label before counting a unit as ready. The guide names no minimum firmware. No conformance test result against the Ambition 2027 criteria is published. |
| Zebra LI4278 | Hardware cannot | Linear imager, 1D only. Zebra's own specification sheet lists UPC/EAN, Code 128 including GS1-128, Code 39, Code 93, the 2 of 5 family, Codabar, MSI and GS1 DataBar, and nothing else: no QR Code, no Data Matrix, no 2D symbology of any kind. There is no image sensor able to see a 2D code, so no firmware update can ever add GS1 Digital Link to this model. Any lane still running one needs a replacement, not an upgrade path. |
| Zebra DS9808 | Confirmed: discontinued | A 2D imager, but the product line has moved on: Zebra's own DS9800 Series support page gives a Last Sale Date of 2 Aug 2019 and a Service and Support Discontinuation Date of 1 Oct 2024, already passed, naming the DS9908 and DS9908r as replacement, and it has not appeared in any of the last eight quarterly Evolution Update notes, so no firmware of any kind, GS1 Digital Link included, has shipped for it in over two years. Whether it could technically be updated is moot. Any lane still running one is a replacement decision, not a firmware wait. |
| Datalogic Magellan 9400i | Vendor documents handling | Digital imagers in all planes read 1D and 2D codes. The product page makes no Digital Link statement, but Datalogic's configuration tool does: Aladdin's repository carries a GS1 Digital Link parameter group for this model from release DR9401543 onward, still present in the newest release it publishes, and a help topic describes the modes. The scanner can ignore a Digital Link label set, send the first label of the set, send every label prefixed with a set id, or give priority to the GS1 2D label, and a transmit format setting converts the GTIN out of a GS1 2D label into a 1D label format. That is documented label handling, not a conformance result against the Ambition 2027 criteria. Distributors list the model as discontinued, replaced by the 9600i, so a Sunrise 2027 lane here is a replacement decision rather than a firmware one. |
| Datalogic Magellan 9800i | Vendor documents handling | The datasheet lists Aztec, Data Matrix, QR Code and Micro QR read through imagers in every plane, with optional Digimarc. Datalogic's configuration tool goes further than the product page: Aladdin carries the same GS1 Digital Link parameter group for this model from release DR9401542 onward, still present in the newest release it publishes, with its own help topic. The modes cover ignoring a label set, sending the first label, sending every label prefixed with a set id, and giving priority to the GS1 2D label, and a transmit format setting converts the GTIN into a 1D label format. No conformance test result against the Ambition 2027 criteria is published. Distributors list the model as discontinued, replaced by the 9900i, so a Sunrise 2027 lane here is a replacement decision rather than a firmware one. |
| Datalogic Magellan 9550i | Vendor states support | Datalogic states out of the box support for GS1 2D Digital Link, and reads QR Code, Data Matrix, GS1, PDF417 and Aztec. Its configuration tool matches that: every release Aladdin publishes for this model, from DR9401697 onward, carries the GS1 Digital Link parameter group, with a help topic at DR9401721. It is sold as a drop-in replacement in the same form factor as earlier Magellan bi-optics. No conformance test result is published. |
| Datalogic Magellan 9600i and 9900i | Vendor states ready | The current Magellan multi-plane generation, introduced at NRF in January 2023. Datalogic describes both as GS1 2D Digital Link and Digimarc ready, and the 9600i as a drop-in replacement for the 9300 and 9400. For the 9900i the configuration tool confirms it: Aladdin publishes the GS1 Digital Link parameter group from release DR9401592 onward, with help topics at three releases since. Aladdin publishes no configuration for the 9600i at all, so nothing there is confirmed for that model. No conformance test result against the Ambition 2027 criteria is published for either. |
| Honeywell Genesis XP 7680g, Stratos, Solaris | No vendor statement | All three are 2D area imagers, not lasers, so the hardware is not the barrier. Honeywell's public product pages describe 1D and 2D symbology support and, for some models, GS1-128 and GS1 DataBar, but none state GS1 Digital Link URI parsing. Firmware and configuration guides that might say more sit behind hsmftp.honeywell.com, the same sign in gate already recorded on the firmware tab, unchanged since the Brady Corporation sale closed 3 Aug 2026. Not verified, not ruled out. |
| Opticon fleet (NLV, MDI, F-70, OPR, OPI models) | No vendor statement | The nine Opticon models on the firmware tab are all 2D CMOS imagers. Opticon's own manuals, published openly with no login, describe GS1 application identifier support and data edit output for logistics and POS use, which is GS1-128 and GS1 DataBar element string handling, not Digital Link URI parsing. No Opticon document found states support for a GS1 Digital Link URI. Opticon's documentation is the easiest of the six vendors to read; this is a genuine gap in what it says, not a fetch failure. |
| Is imager enough | No | GS1's own guideline warns that "not all imaging scanners will be capable of the Ambition 2027 goal". The bar is the full criteria above, including reversed reflectance and the latency budget. A scanner that decodes a QR code on the bench can still miss 300 ms at lane speed. Per model conformance is worth getting from Zebra and Datalogic in writing. |
The one thing worth doing this quarter
Run the GS1 capability test suite on a real lane. Free
Release 1.1, February 2025. 35 tests, around 30 minutes once set up, results recorded in a supplied spreadsheet. It is the only objective readiness gate that exists, and it tests scanner and host together rather than separately. Tests 1 to 10 cover GTIN only baselines, 11 and 12 check that non GS1 barcodes are correctly ignored, 13 to 27 walk the AIs across all three 2D types, and 28 to 35 cover co-located barcodes on dual marked packs. The last two groups are where real fleets fail and are not things anyone would think to test unprompted.
Normative documents, and their current versions
| Document | Version | Date |
|---|---|---|
| POS Host and Backend Systems Playbook | 1.0.1 | May 2026 |
| Creation and Printing Playbook | 1.0.1 | Jun 2026 |
| 2D at Retail POS Implementation Guideline | 1.1.0 | Dec 2025 |
| Solution provider 2D readiness criteria | 1.0.0 | Apr 2025 |
| 2D Barcodes in Retail test suite | 1.1 | Feb 2025 |
| Playbook for Retail Scanners | 1.0.1 | May 2026 |
| Digital Link Standard: URI Syntax | 1.7.0 | Aug 2026 |
| Fresh Fruit & Vegetable Labelling Consumer Units Guideline | 1.1 | Sep 2026 |
The host playbook from May 2026 is the one document on this list written for POS software implementers, and its companion playbook for retail scanners, also May 2026, is the one for whoever configures the scanner: it names Mode 1, transmitting only the GTIN, as the minimum for Ambition 2027. The Digital Link URI Syntax standard reached Release 1.7.0 in Aug 2026; it defines the web address a 2D code carries, which is what the host has to parse. New on this list in Sep 2026: the fresh produce labelling guideline, revised for the first time since 2015, now names all three retail 2D types for loose and in-store labelled produce, with worked examples carrying net weight (AI 3103) and, on an in-store label, the amount payable (AI 3922). A weighed item can therefore reach the till as a 2D code whose price is in the code rather than in the item file, and a host that reads only the GTIN from it will get that item wrong. Read at ref.gs1.org. Separately, and corrected on 14 Sep 2026: GS1's published list of 2D ready solution providers is not empty. Read live from gs1.org it names 32 companies across four categories, including six under POS Scanner: Newland AIDC, Honeywell, Datalogic, Zebra, Keyence and TSC. Four of those six are already vendors on this board. The list is built from a script driven dropdown, so a plain page fetch returns nothing and reads as an empty list, which is how this board came to state the opposite. Entries are vendor self attestation, published by GS1 with no warranty of accuracy, so treat a listing as a claim to put to the vendor rather than a conformance statement.
There is no public scoreboard for POS readiness. Read numbers carefully
No GS1 readiness survey for 2025 or 2026 could be found. Two named retailers are now live: Tesco replaced the linear barcode entirely, not dual marked, with a single QR code powered by GS1 on its own-label sausage range, 13 lines, from April 2026, confirmed by Tesco's own supply chain development and change director and by GS1 UK's chief executive. Carrefour followed by May 2026, putting QR codes powered by GS1 on 50 private label products, starting with its own wine range and expanding into spirits, textiles and batteries, confirmed by GS1's own case study and by Carrefour's Global and France Chief Digital Officer, named in independent trade coverage. No source found states whether Carrefour kept the linear barcode alongside the QR code or removed it, unlike Tesco's confirmed exclusive switch. Both are own label ranges, and that is the route GS1 itself points retailers to: its position paper on single 2D barcodes invites retailers to drop the linear barcode early on goods they produce or label in a closed or semi closed chain. Release 2.0 of that paper, July 2026, widens it to retailer-exclusive products: branded goods made only for one retailer, such as special editions, exclusive pack sizes and bundles. Other branded goods keep both barcodes until every retailer can scan 2D only. The consequence for a lane is direct. A pack carrying only a QR code cannot be sold through a scanner that does not read 2D, and under Release 2.0 that pack may carry a national brand's name, so a retailer moving its own or exclusive ranges to single 2D needs those lanes ready when the packs arrive, not by the end of 2027. That is two retailers, not a scoreboard. The widely quoted "84 percent of retailers planning" and "68.5 percent still on laser" figures are from a March 2020 GS1 US study and are six years old. The only current wider figure found is fewer than 20 percent of Amazon brand partners actively planning, and that came from one person's informal poll reported in February 2026. If a vendor quotes a 2026 global adoption percentage, ask for the source. The end of 2027 date itself has not slipped, re-checked 14 Sep 2026 and again 6 Oct 2026, but GS1 publishes no dated interim milestones against it. The one non dated threshold it does publish is in the December 2025 implementation guideline: dual marking continues until 90 percent of POS scanning solutions are 2D capable.
Checked at source 31 Oct 2026 at 14:28
Fiscalisation
61 marketsEurope in detail, the rest of the world by exception. We re-check every European deadline ourselves and every correction carries its source in the row, because this is the tab where being a year out costs the most.
How much of this reaches the till
Certified till20
A certified device, fiscal memory, secure element or certified till software is required at the point of sale.
Real time22
Every sale is transmitted or cleared with the authority, but the till itself is not certified.
Invoice only10
Mandatory e-invoicing exists, but it does not reach an ordinary consumer sale.
None9
Nothing at the till. Receipts are a commercial document, not a tax document.
Four levels, ordered by how deep the rule goes into the point of sale. The distinction that matters is between a regime that regulates invoices and one that regulates the till. Plenty of countries have mandatory e-invoicing that an ordinary consumer sale never touches, and a handful of large economies regulate nothing at the till at all. Counts are derived from the tables below.
Benelux and the neighbours
NetherlandsNone
geen fiscalisering
No fiscal memory, no signing device, no reporting, no receipt QR, no mandatory certification. Obligations are the general bookkeeping ones under art. 52 AWR: complete and correct records, detail data retained not just Z totals, seven years. The Belastingdienst handreiking is guidance aimed at developers, not law. The Keurmerk Betrouwbare Afrekensystemen is voluntary and market run, a commercial differentiator rather than a compliance gate. One of the few European markets that regulates nothing at the point of sale.
Next: nothing scheduled
BelgiumCertified till
GKS 2.0 / SCE
Certified POS software plus a Fiscal Data Module. GKS 2.0 drops the VAT Signing Card and has the FDM transmit straight to FPS Finance, which is an architectural change rather than a firmware bump. Tolerance was extended twice and ended 30 Jun 2026; new hospitality entrants have gone straight to 2.0 since 1 Jul 2026. Migration waves key off the purchase date of the register, so install bases need auditing now, and there are three of them, not two: 1 Jul 2027 for registers bought up to 31 Dec 2017, 1 Jul 2028 for 2018 to 2021, and 1 Jan 2029 for registers bought from 1 Jan 2022. What is signalled but not enacted is extension to the whole hospitality sector, removing the threshold that exempts smaller operators, plus the carwash trade; the royal decree is sitting with budget discussions. Wave detail and scope per ITAA and Belgian practice guidance, read 14 Sep 2026.
Next: 1 Jul 2027, registers bought up to 31 Dec 2017
GermanyCertified till
KassenSichV / TSE
Certified TSE signing every transaction, DSFinV-K export on demand, receipt issued for every sale, ten year retention, unannounced Kassen-Nachschau. The reporting duty via Mein ELSTER has run since 1 Jan 2025 and the catch up deadline passed in July 2025, so missing or wrong registrations are now audit exposure. New systems must be reported within one month of commissioning. From Jan 2026 restaurant food is back to 7 percent while drinks stay 19, which needs clean rate separation in mixed sales. Signalled, not yet enacted, but a step further on: the Bundeskabinett approved the bill as a Regierungsentwurf on 23 Sep 2026, still targeting a till with a TSE compulsory from 1 Jan 2028 for businesses above EUR 100,000 turnover, with cash sales up to EUR 12,000 exempted, and replacing the paper receipt duty with an electronic receipt by QR code or NFC. It still needs the Bundestag and the Bundesrat (Bundesfinanzministerium).
Next: rolling, one month per new system
FranceCertified till
NF525 + e-invoicing
The certification cliff was cancelled. Finance Law 2025 had removed editor self attestation, pushing everyone toward accredited NF525 or LNE certificates by 31 Aug 2026. Finance Law 2026 article 125, adopted 19 Feb 2026, reinstated the individual attestation. Either route is now valid and no third party audit is compulsory. Separately the e-invoicing mandate went live on 1 Sep 2026: everyone must be able to receive, large enterprises and ETIs must issue. The economy ministry said on launch day that no penalties will be applied during 2026. For retail the POS facing piece is B2C e-reporting, not e-invoicing.
Next: 1 Sep 2027, SMEs must issue and e-report
Rest of Europe
| Market | Reaches | Regime | What the till has to do | Next |
|---|---|---|---|---|
| Italy | Certified till | RT | Certified registratore telematico transmitting daily takings. Since 1 Jan 2026 payment terminals must be logically linked to the RT, registered through Fatture e Corrispettivi. Penalties 1,000 to 4,000 euro for a missing link. The instant receipt lottery still has not launched; the weekly one runs normally. | rolling |
| Spain | Certified till | VeriFactu | Chained, hash linked, signed invoice records with a QR on every invoice, either streamed to AEAT or stored tamper evidently, from software carrying a producer declaration. Delayed a second time by Real Decreto-ley 15/2025 of 2 Dec 2025, a royal decree-law rather than a royal decree, which is what to search for in the BOE: its article 3 sets two deadlines, software adapted before 1 Jan 2027 for Corporate Income Tax taxpayers and before 1 Jul 2027 for every other obligated party. TicketBAI is separate and is mandatory across the three Basque provinces. Navarra does not use TicketBAI: it has its own regime, branded NaTicket, whose technical specification is not final and which is not yet in force. | 1 Jan 2027 |
| Portugal | Certified till | ATCUD | AT certified software, ATCUD code and QR on every invoice, monthly SAF-T PT. From Jan 2027 a PDF invoice needs a qualified electronic signature to count as an e-invoice. | 1 Jan 2027 |
| Poland | Certified till | Kasy online + KSeF | Certified online cash registers streaming to the central repository, required by designated sectors rather than universally, plus structured e-invoicing through KSeF: large enterprises above PLN 200m turnover from 1 Feb 2026, other VAT payers from 1 Apr 2026. The duty to receive through KSeF applied to everyone from 1 Feb 2026. Micro entrepreneurs invoicing under PLN 10,000 gross a month were carved out and join on 1 Jan 2027, which is also when their transition periods end. On 16 Sep 2026 the Ministry of Finance announced that the deferral of KSeF penalties will be extended to 31 Dec 2027. That needs a change in the law, which the ministry has started drafting, so until it passes the enacted date still stands. Ministerstwo Finansów, gov.pl. | 1 Jan 2027 |
| Greece | Certified till | myDATA | Certified registers linked to AADE, QR on receipts, payment terminals interconnected with the register per A.1098/2022 and A.1155/2023. B2B e-invoicing reaches the remaining businesses, those up to EUR 1m gross revenue, from 2 Nov 2026, postponed from the 1 Oct 2026 date this card previously carried: AADE and the Ministry of National Economy and Finance announced the change on 30 Sep 2026. A business not already issuing may run its existing accounting, ERP software or the state's own timologio and myDATAapp apps in parallel to 31 Jan 2027; from 1 Feb 2027 only an e-invoicing provider or the state apps may be used. Joint Decision A.1128/2025 still governs the underlying regime. AADE's own site refused a plain fetch for this check; the dates rest on several outlets reporting the announcement consistently. | 2 Nov 2026 |
| Austria | Certified till | RKSV | Signature creation device, AES-256 chained signatures, QR on the receipt, DEP export. Mandatory above 15,000 euro turnover with more than 7,500 in cash. The Registrierkassensicherheitsverordnung was amended (BGBl. II Nr. 134/2026): the simplified-regime turnover threshold rose from EUR 30,000 to EUR 45,000 from 1 Jan 2026, and from 1 Oct 2026 a receipt may be issued digitally, a customer retrieving it from an on site screen or a QR code rather than the till handing one over, though a paper receipt must still be produced on request. The annual receipt (Jahresbeleg) still must be read out and verified by 15 Feb each year, a fine of up to EUR 5,000 for a late check. | 15 Feb 2027 |
| Romania | Certified till | AMEF + RO e-Factura | Fiscal cash registers (AMEF) alongside B2B and B2C e-invoicing. From 1 Jan 2026 e-Factura scope extends to non resident VAT registered customers and the submission window relaxes from 5 calendar to 5 working days. The AMEF hardware regime, a physical fiscal device connected to ANAF with an electronic journal and a QR code on every receipt, is re-verified current against Romanian accounting and business press; ANAF's and the Ministry's own pages could not be read directly this check. A parliamentary bill backed by a favourable Government opinion of 30 Mar 2026 would let a certified software application (AMEF-V) stand in for the physical device; opposed by the cash register distributors' association, not law, and the Government's own estimate puts implementation six to twelve months after any enactment. | in force |
| Norway | Certified till | Kassasystemlova | The Nordic exception. The supplier files a product declaration with Skatteetaten and only declared systems may be used. Electronic journal, X and Z reports, no delete function, SAF-T Cash Register export with a digital signature. Skatteetaten publishes the list of declared systems. | none |
| Serbia | Certified till | E-fiskalizacija | ESIR sends each sale to a local or virtual PFR, which signs it with a cryptographic security element and transmits in real time, with an offline buffer. QR on the receipt, and both ESIR and PFR must be on the accredited list. From 1 Apr 2026 retail sales to corporate cardholders need an e-invoice issued after the fiscal receipt. An amendment in force since 8 Sep 2026 (Sl. glasnik RS 80/2026) adds an immediate one year ban on business operations for a receipt whose QR code was not generated through the Tax Administration's own system, points to a different receipt, amount or taxpayer, or was altered afterwards. | 1 Jan 2027 |
| Albania | Certified till | Fiskalizimi | No turnover threshold, it applies from the first sale. Certified software hashes each invoice (NSLF), signs with the taxpayer certificate, and the administration returns an NIVF; both print on the receipt. Cash points need registered devices, offline ceiling is 48 hours, a failed device must be replaced within 5 days. A generic ERP connector or Peppol access point is explicitly not sufficient. Separately, under Law 9920/2008 art. 59/3 as amended by Law 79/2025, every cash sale point must also carry a POS/POI payment terminal: accommodation, transport and public bodies from 30 May 2026, already passed, and every remaining cash handling business by 31 Dec 2026. This is a payment acceptance mandate alongside fiscalisation, not a change to the invoicing regime itself. | 31 Dec 2026 |
| Ukraine | Certified till | RRO / PRRO | Hardware RRO or state certified software PRRO registered with the tax service, with cloud PRROs transmitting continuously. QR on the receipt for verification. Covers cash, card and payment service provider settlements; direct IBAN transfers are exempt. Fines are 100 percent of transaction value, then 150. | in force |
| Russia | Certified till | 54-FZ online kassa | The most invasive model on this page. Every till needs a replaceable cryptographic fiscal drive registered with the FNS plus a contract with an accredited OFD that relays every receipt. QR on the receipt, versioned FFD payload, 30,000 rouble fine per payment without one. VAT rose to 22 percent on 1 Jan 2026 and the inspection grace period has lapsed. The FNS plans to accept only FFD 1.2 from 1 Mar 2027, retiring 1.05 and 1.1. That date is now reported consistently across the Russian cash register and accounting trade press rather than by one outlet, but no order number has been published for it and the FNS itself has not been read directly, so it stays an announced plan and not an enacted instrument. The board's minimum FFD version question is closed that far and no further. | in force |
| Bosnia | Certified till | Fiscalisation Law | Entity level hardware fiscal registers today. The new law is a Federation of BiH entity law, not a state law: the Zakon o fiskalizaciji transakcija u Federaciji BiH, published in the Official Gazette of FBiH 9/26 on 4 Feb 2026 and in force eight days later, on 12 Feb 2026. It moves fiscalisation off hardware devices and into software: invoices signed digitally and sent to the tax administration in real time through the ESET system and the central fiscalisation platform, with a QR for verification. Application waits on implementing regulations and on the administration standing the system up, and the law sets the outside date at 12 Aug 2027. Existing fiscal devices may keep running three to four years from the start of application. Being an entity law, it does not by itself reach Republika Srpska or Brcko. Source: the Official Gazette's own issue 9/26, corroborated by Zenicablog and Sodalive.ba. | 12 Aug 2027 |
| Hungary | Real time | e-nyugta | Since 1 Sep 2026 around 270,000 taxpayers report aggregated daily receipt data to NAV within three calendar days, split by VAT rate, via cloud register, the KOBAK portal or M2M. Grace period to 31 Dec 2026, fines after. Hardware e-cash registers become mandatory 1 Jul 2028. | 1 Jan 2027 |
| Croatia | Real time | Fiskalizacija 2.0 | Mandatory B2B and B2G e-invoicing plus e-reporting between VAT registered taxpayers since 1 Jan 2026, with monthly e-reporting by the 20th. B2C is not in the e-invoicing mandate: consumer sales stay under receipt fiscalisation, and what changed on 1 Jan 2026 there is that fiscalisation now covers all payment methods rather than cash alone. Porezna uprava treats the two as separate procedures. From 1 Jan 2027 the duty to issue extends to taxpayers not registered for VAT, who until then need only be able to receive. Read 14 Sep 2026. | 1 Jan 2027 |
| Czechia | Real time | EET 2.0 | EET was abolished with effect from 1 Jan 2023, so nothing reaches the till today. Reintroduction as EET 2.0 was approved by the Chamber of Deputies on 15 Jul 2026, returned with amendments by the Senate on 19 Aug 2026, and finally adopted when the Chamber overrode the Senate on 9 Sep 2026. President Pavel signed the act on 17 Sep 2026 and the duty to record sales starts 1 Jan 2027. Publication in the Collection of Laws has still not happened, which is now confirmed rather than assumed: the state's own eet.gov.cz says publication is still to follow, so the act has no Sb. number to cite yet. The two dates that matter before January are the state's own: EET 2.0 functions appear in the tax information box DIS+ on the MOJE dane portal from 1 Nov 2026, which is where a business registers and collects the certificate it has to hold to send anything at all, and the free MOJE eet web application for the smallest businesses launches 1 Dec 2026. Covers payments involving in person contact: cash, card, QR and mobile. There is no obligation to issue a receipt for EET 2.0 purposes, which separates this regime from the German and Austrian ones. Self employed people in the first flat tax bracket up to CZK 1m turnover can opt out entirely in exchange for a higher monthly prepayment. Source: eet.gov.cz and Financni sprava. | Jan 2027 |
| United Kingdom | None | none | Nothing at the till. Making Tax Digital is digital record keeping and API filing by the business, not fiscalisation: no receipt format, no device certification, no transaction reporting. The announced B2B mandate is four corner Peppol with no real time feed to HMRC. | 1 Apr 2029 |
| Switzerland | None | none | Nothing at the till, explicitly unlike Germany. The obligation sits on the cash book: daily, chronological, unalterable entries, full books above CHF 500,000 turnover, ten year retention. | none |
Beyond Europe
| Market | Reaches | Regime | What the till has to do | Next |
|---|---|---|---|---|
| Americas | ||||
| Brazil | Real time | NFC-e | Sign the XML with an ICP-Brasil certificate, get per sale authorisation from the state SEFAZ, print the DANFE with a QR derived from the state issued CSC, with offline contingency. Since 3 Aug 2026 every NFC-e must carry populated IBS and CBS fields, except from Simples Nacional sellers, who follow on 1 Jan 2027 (Ato Conjunto RFB/CGIBS 4/2026). The automatic rejection that was to enforce it, rejection 1115, was postponed without a date by version 1.51 of Nota Tecnica 2025.002 and is still undated in version 1.52 of 1 Oct 2026, so a note missing the fields is authorised today but is still in breach. For 2026, Ato Conjunto 5/2026 keeps a seller in the national compliance programme if its correct IBS and CBS fields rise steadily and it corrects flagged inconsistencies by 31 Dec 2026. Sao Paulo retired SAT-CF-e on 31 Dec 2025 and moved retail to NFC-e. | 1 Dec 2026 |
| Mexico | Real time | CFDI 4.0 | Build the CFDI XML, sign with the CSD, have it stamped by an authorised PAC. Walk in customers get a simple ticket, consolidated into a factura global against the generic RFC. | none |
| Chile | Real time | Boleta Electronica | Signed XML DTE drawing folios from an authorised CAF range, reported to SII. The daily consumo de folios report was abolished from 1 Aug 2022. Under SII Res. Ex. 53 of 29 Apr 2025 every in person sale must hand the buyer the boleta, printed or virtual (email, SMS, messaging or QR): from 1 May 2025 where the seller has a printing device, from 1 Mar 2026 for everyone else. | none |
| Colombia | Real time | Documento equivalente POS | Signed XML pre-validated by DIAN before the receipt reaches the customer, which puts authority latency on the critical path. If the seller's own system fails, a paper document may be issued and must be converted and sent to DIAN within 48 hours of the fault being fixed; if DIAN's service fails, the 48 hours run from its restoration (Res. 165/2023 art. 37). Paper POS tickets are no longer valid. | in force |
| Argentina | Real time | Factura electronica or Controlador Fiscal | A seller may issue electronic receipts under RG 4291, which ARCA authorises, or use an ARCA homologated fiscal controller under RG 3561, or both, without telling ARCA which. ARCA Resolucion General 5893/2026, published in the Boletin Oficial on 31 Aug 2026, rewrites articles 6 and 7 of RG 4290 from 1 Nov 2026 and keeps that choice for VAT registered, exempt and Monotributo sellers. No seller is left who must use a controller. The only groups without a choice must issue electronic receipts only: SMEs dealing inside the MiPyMEs credit invoice regime, sellers outside VAT from 1 Mar 2027, and the activities in Annex II of RG 4291. We had read RG 5893 as leaving the controller compulsory for high volume retail. Its own text says otherwise, so Argentina sits in the real time class, with a certified controller as one way to comply rather than the rule. | 1 Mar 2027 |
| Peru | Real time | SEE boleta | Signed UBL boleta with QR at the till, transmitted to SUNAT in a resumen diario, same day or up to the seventh calendar day. | none |
| Uruguay | Real time | CFE e-Ticket | Obtain a CAE numbering range from DGI, issue the signed XML e-Ticket, transmit and retain five years. An e-Ticket above UI 5,000 net of VAT must reach DGI before it goes to the buyer (DGI Res. 531/022). Universal for all VAT taxpayers, minimum VAT payers included, since 1 Jan 2025 (DGI Res. 2548/023). | complete |
| Costa Rica | Real time | Tiquete v4.4 | XML v4.4 with a 50 digit clave signed with the taxpayer key, sent to Hacienda's reception service. No fiscal validity until accepted, and no batch option. Version 4.4 has been mandatory since 1 Sep 2025, and TRIBU-CR, Hacienda's new tax platform, has run since 6 Oct 2025. An update to the v4.4 annexes, adding reference codes and a payment receipt document type, is mandatory from 1 Nov 2026. | in force |
| Dominican Rep. | Real time | e-CF | DGII authorised invoicing system issuing signed XML e-CF; consumer sales use type 32. DGII validates and returns a tracking number. A consumer invoice below RD$250,000 is filed as a per invoice summary (RFCE) instead of the full XML, which the issuer keeps. | 15 Nov 2026 |
| United States | None | none | No fiscalisation at all. No certified device, no fiscal memory, no clearance, no mandated receipt format. The receipt is a commercial document. The engineering effort is entirely rate and sourcing accuracy across more than 10,000 jurisdictions (the US GAO cites estimates of 10,000 to 12,000), product taxability, exemption certificates, marketplace facilitator rules and economic nexus. A genuinely different model, not a gap. Since the Mint stopped making circulation pennies in Nov 2025, states have issued cash rounding guidance; Washington's rounds the cash total only and leaves the sales tax computed on the unrounded price. | none |
| Canada | None | none, except Quebec | Nothing federally; the CRA lists e-invoicing only as an opportunity under study, with no mandate or date. Quebec is the exception: restaurant establishments, which have taken in bars since 2016, caterers, and paid passenger transport need a certified SEV transmitting to MEV-WEB and printing a QR plus transaction number. Quebec retail generally is not covered. | in force |
| Middle East | ||||
| Saudi Arabia | Real time | ZATCA Fatoora | Phase 2. B2C simplified invoices are cryptographically stamped locally, carry a TLV QR code on the receipt and are reported to ZATCA within 24 hours; B2B standard invoices are cleared before issue. UUIDs, hash chaining and anti tamper controls throughout. Wave 25 halved the threshold to SAR 187,500. | 1 Feb 2027 |
| Turkey | Certified till | YN OKC + e-Arsiv | Sales run on a GIB approved new generation cash register (YN OKC) with secure fiscal memory, TSM connectivity and Z reports matched to GIB. Above the invoice threshold, 12,000 TL for 2026 (VUK 588), an invoice replaces the receipt, and since 1 Jan 2026 it must be e-Arsiv for every taxpayer outside e-Fatura (simplified method traders follow on 1 Jan 2027). Since VUK 593 of 8 May 2026 a YN OKC may issue e-Fatura and e-Arsiv documents itself. Communique 557 of 30 Dec 2023 retired old generation devices by 1 Jul 2024 and requires EFT-POS enabled registers to hold an agreement with a bank or payment service provider. A 1 Oct 2026 obligation for pharmacies and opticians has never been found at GIB, so the board carries no such date. | 1 Jan 2027 |
| United Arab Emirates | Invoice only | PINT AE | Peppol five corner exchange through an accredited service provider with a reporting leg to the FTA. Scope is B2B and B2G, so the retail till is not affected for ordinary consumer sales. | 1 Jan 2027 |
| Israel | Invoice only | Allocation number | Above the threshold, a tax invoice to a business customer claiming input VAT needs an allocation number from the tax authority API printed on it. Does not apply to private consumers, so an ordinary retail till is untouched. The threshold fell to NIS 10,000 on 1 Jan 2026 and to NIS 5,000 before VAT on 1 Jun 2026 (VAT Execution Directive 01/2025); no lower step is published. | in force |
| Jordan | Real time | JoFotara | Every invoice including B2C is submitted for validation and the authority returns a QR that must appear on the document, so this one does reach the till. Four year tamper proof retention. | undated |
| Oman | Real time | Fawtara | PINT OM through an accredited service provider, pilot of about 100 companies since Aug 2026. Consumer sales are in scope: per the Tax Authority's own service provider FAQ, the seller's provider submits the tax data of a B2C invoice to the authority and the receipt carries a QR code the buyer can validate. The B2C submission deadline and the QR details are still to be announced. Decision 189/2026 starts supplies above OMR 5m on 1 Apr 2027 and everyone else on 1 Oct 2027 (as reported; the authority's FAQ page still shows an older phase table). Nothing at the till today. | 1 Apr 2027 |
| Qatar | Invoice only | GTA e-invoicing | A draft law and implementing regulations were approved by the Council of Ministers on 6 May 2026 and still need the Shura Council and the Amir; pilot running. No start date is confirmed; 1 Jan 2027 is the anticipated one (EY). B2B is clearance, and B2C live reporting is expected, which would reach the till. Specs still pending. | 1 Jan 2027 |
| Africa | ||||
| Egypt | Real time | ETA e-receipt | Each POS device is registered with the authority, holds a class 2 digital certificate and submits every receipt in real time over TLS; the authority returns a UUID and the receipt carries a QR. Rolling out by ETA decision, group by group: the latest is Decision 361 of 2025, phase 9, and no deadline for the remaining groups is published. | undated |
| Kenya | Real time | eTIMS | Every invoice including B2C is transmitted before issue and the authority returns a control unit invoice number, signature and QR that print on the receipt. Integration is via software control units, not certified hardware, so the burden is integration rather than certification. Since 1 Jan 2026 KRA validates income and expenses on returns against eTIMS data. A stock management function announced on 7 Sep 2026 will require stock movements to be recorded in TIMS or eTIMS; no go live date yet. | in force |
| Ghana | Real time | E-VAT | Invoices and sales receipts go through a GRA certified invoicing system to the virtual sales data controller, which returns a clearance number, signature, QR and timestamp to embed on the document. Onboarding is done in batches, a selected business getting a few weeks' notice; a batch of 1,217 was trained in May 2026. No published date for the final tranche, and none for small taxpayers or retail specifically. The VAT Act 2025 (Act 1151) raised the goods registration threshold to GHS 750,000 and abolished the Flat Rate Scheme from 1 Jan 2026. | undated |
| Tanzania | Certified till | EFD / VFD | Fiscal receipt from an approved device for every sale: sequential numbering, SHA1 with RSA signature, receipt verification code and QR, daily Z report, real time submission with offline queueing. A proposed move to token based pre-clearance would turn an offline tolerant design into a blocking online dependency. | undated |
| Nigeria | Real time | EFS / MBS | Clearance style: transmit to the revenue service platform and receive an invoice reference number. Large taxpayers first. Per the revenue service's notice of 16 Feb 2026, as reported, medium taxpayers went live on 1 Jul 2026 with enforcement from Jan 2027, and emerging taxpayers go live on 1 Jul 2027 with enforcement from Jan 2028, each only after pilot and review phases. On the B2C question: the revenue service's position, as reported by advisers reading it, is that at final rollout the scheme covers both B2B and B2C with different modalities for each, and no modality for consumer sales has been published: no threshold, no receipt format and no point of sale requirement. So retail is in scope in principle and undefined in practice. | Jan 2027 |
| Angola | Certified till | Facturacao electronica | Invoicing software must be validated by the AGT, plus SAF-T (AO) and inventory file submission, under Presidential Decree 71/25 of 20 Mar 2025, which replaced Decree 292/18. Every supply needs an invoice, retail included: a private buyer is exempt only at vending machines, some ticketed services and licensed street or market traders, and even there a Talao de Venda or Factura-Recibo is still required. E-invoicing applies to large taxpayers and state suppliers since 1 Jan 2026 and to every general and simplified regime VAT taxpayer after the first 12 months, which the AGT puts at 1 Jan 2027 with no extension. | 1 Jan 2027 |
| Morocco | Invoice only | DGI e-invoicing | Clearance of XML on the DGI platform with ICE validation and a ten year archive. The decree that would set the calendar under CGI article 145-IX had not been published in the Bulletin officiel at last check, so there is no binding start date. B2B and B2G only in the planned first phase, B2C is deferred, so the till is out of scope for now. | undated |
| South Africa | None | consultation | Nothing required today. SARS published a VAT Modernisation consultation paper on 17 Aug 2026 proposing structured e-invoicing and near real time reporting; summaries of the paper give phased mandatory implementation from 2030, large taxpayers and government first and B2C in later phases. FAQs followed on 8 Sep and translations on 15 Sep, and the comment period closed on 16 Oct 2026. SARS's own VAT Modernisation page states no implementation date, no draft legislation date and no next milestone, so the row carries no deadline. | undated |
| Asia Pacific | ||||
| Taiwan | Real time | eGUI | Heavy till involvement. Invoice numbers are allocated by the ministry, so the POS cannot generate its own and must manage number block inventory. Issue the eGUI, print a QR receipt or write to a carrier, upload MIG 4.1 XML (older versions refused since 1 Jan 2026, as reported). B2C invoices, corrections, voids and allowances upload within two days from the day after issue, B2B within seven, and unused number blocks are reported within 10 days after each two month period. | complete |
| South Korea | Real time | Cash Receipt | A genuine till obligation: capture a buyer identifier and get an approval number from the tax service. Designated sectors must issue automatically at KRW 100,000 and above whether or not the customer asks, and when the buyer gives no identifier the seller self issues to the National Tax Service code number within five days. Penalty is 20 percent of the unissued amount for a mandatory sector failure. | none |
| Vietnam | Real time | Decree 254/2026 | The clearest recent case of an invoice regime pushed down into the cash register. Since 1 Jul 2026, under Decree 254/2026 (replacing Decree 123/2020 as amended by Decree 70/2025), sellers dealing directly with consumers in retail, food service, hotels and passenger transport generate the e-invoice from the till, with the data connected to the tax authority. Household and individual businesses above VND 1 billion a year must use coded or connected cash register e-invoices, and presumptive lump sum tax for households ended on 1 Jan 2026. A seller already on coded e-invoices need not switch. | in force |
| India | Invoice only | GST e-invoicing | B2B only: push JSON to an invoice registration portal and print the returned IRN and signed QR. Retail B2C sales need no IRN. Separate rule: above AATO 500 crore a dynamic QR carrying payment details goes on B2C invoices. B2C e-invoicing remains a voluntary pilot. | not dated |
| China | Invoice only | Fully digitalised e-fapiao | No Golden Tax hardware at the till any more. Fully digitalised fapiao are issued from the tax platform and validated centrally, on customer request rather than automatically per sale, and ordinary retail receipts are not fiscalised. The VAT Law in force since 1 Jan 2026 keeps paper and electronic invoices equally valid and promotes electronic ones (article 34). Exception: retail fuel stations must issue a fully digitalised e-fapiao for every sale, immediately and from the transaction data, through the tax authority's Leqi platform, before 1 Nov 2026 (STA Announcement 2026 No. 11). | in force |
| Malaysia | Invoice only | MyInvois | Cleared e-invoices return a unique number and validation QR. Consumers who do not ask get a normal receipt covered by a consolidated periodic e-invoice, but from 1 Jan 2026 consolidation is prohibited above RM10,000, which is the rule that bites at a till. Taxpayers below RM3m are exempt (timeline updated 30 Aug 2026), and phase 4 businesses up to RM5m are reported to have an interim relaxation to 31 Dec 2027. | in force |
| Philippines | Invoice only | EIS + ESRS | Covered taxpayers must issue system generated structured e-invoices that a printout does not satisfy. By 31 Dec 2026 (RR 26-2025): e-commerce taxpayers above micro, the Large Taxpayers Service, large taxpayers, and anyone invoicing from accounting or invoicing software. POS system users are explicitly in a later phase, with exporters and incentive registered enterprises, which starts only when the BIR's system is ready, by a separate regulation. Transmission to the EIS and sales reporting have no date for anyone yet. | 31 Dec 2026 |
| Indonesia | Invoice only | Coretax e-Faktur | Clearance covers B2B and B2G. A retail taxable business issues a simplified tax invoice, which may be an ordinary till slip, and may aggregate end consumer sales. No B2C or POS mandate. | none |
| Singapore | Invoice only | GST InvoiceNow | Invoice data goes to IRAS through a Peppol access point, and it is not B2B only: point of sale and simplified tax invoice sales are in scope, though they may be aggregated before submission, so nothing is cleared per sale. Phased by registration: new voluntary registrants already; new compulsory registrants and existing registrants with supplies up to S$200,000 from 1 Apr 2028; up to S$1m from 1 Apr 2029; up to S$4m from 1 Apr 2030; everyone else from 1 Apr 2031. | 1 Apr 2028 |
| Japan | None | Qualified Invoice | No device, no reporting. The receipt must carry the issuer registration number and tax split by 8 and 10 percent. Retail, restaurants and taxis may use the simplified qualified invoice, which is the format POS actually implements. The transitional input credit on purchases from unregistered suppliers stepped from 80 to 70 percent on 1 Oct 2026. Per the National Tax Agency, the remaining steps are 50 percent from 1 Oct 2028, 30 percent from 1 Oct 2030 and none from 1 Oct 2031, and from tax periods starting on or after 1 Oct 2026 purchases from any one unregistered supplier above JPY 100 million a year get no credit on the excess. None of this changes what a till prints; it changes what a buyer can reclaim on what the till printed. | 1 Oct 2028 |
| Thailand | Certified till | POS approval (Por.Por.06) | Each cash register or POS that issues abbreviated tax invoices must be approved by the Revenue Department before use, on form Por.Por.06 (VAT Notification No. 46, Revenue Code section 86/6). The approved machine prints TAX INV(ABB) and its registration code on every receipt, numbers receipts in an unbroken sequence and keeps a daily journal for five years. Selling, destroying or moving a machine needs form Por.Por.06.1 at least seven days ahead, so a hardware swap is a filing. No fiscal memory and no reporting to the authority. The signed XML e-Tax Invoice and e-Receipt remain voluntary. | none |
| Australia | None | none | Nothing fiscal at the till. No certified register, no fiscal memory, no reporting. Peppol is government supplier side only and the business eInvoicing right was never enacted as a B2B mandate. Separate from tax: since 1 Jan 2026 grocery and fuel retailers with turnover of AUD 10m or more, or sharing a larger retailer's trademark, must accept cash for in person payments up to AUD 500 between 7am and 9pm. | none |
| New Zealand | None | none | Nothing at the till. Peppol obligations sit on government agencies and their large suppliers: from 1 Jan 2027 agencies must require suppliers with revenue over NZD 33m in each of the two preceding periods to submit e-invoices (Government Procurement Rule 44.2). | 1 Jan 2027 |
The heaviest lifts, in rough order. Brazil, for per sale authorisation against 27 separate state authorities plus a live constitutional tax reform whose IBS and CBS fields have been mandatory since 3 Aug 2026, with the automatic rejection that would enforce them postponed without a date. Russia, for a registered cryptographic fiscal drive inside every till and a commercial intermediary relaying every receipt. Turkey, the only market combining certified fiscal hardware with a parallel e-invoice stack, and since 2026 forbidding standalone and mobile card terminals for businesses in scope. Serbia and Albania, for real signing components with offline buffers, where Albania has no turnover threshold at all and states plainly that a generic ERP connector or Peppol access point is not sufficient. Taiwan is the underrated one: invoice numbers are allocated by the ministry, so the till cannot mint its own identifiers and has to manage number block inventory.
Estate calendar, next 24 months
Nov 2026
02FiscalGreece, businesses with turnover up to EUR 1m start mandatory B2B e-invoicing, postponed from 1 Oct. Parallel use of existing software runs to 31 Jan 2027.
15FiscalDominican Republic, small, micro and unclassified businesses join e-CF.
Dec 2026
01FiscalBrazil, NF-e for non-ICMS taxpayers enters the IBS and CBS regime.
31FiscalAlbania, every remaining cash sale point must be equipped with a POS/POI terminal (Law 79/2025). Hungary, grace period on receipt data reporting ends. Portugal, last day a plain PDF counts as an e-invoice. Philippines, large taxpayers, e-commerce sellers and invoicing software users must be issuing e-invoices; POS users come later.
Jan 2027
01FiscalSpain, VeriFactu wave 1. Portugal, PDF invoices need a qualified electronic signature. Hungary, standard fines begin. Croatia, issuing duty widens. Czechia, EET 2.0 starts. Brazil, Simples Nacional joins. UAE, go live above AED 50m. Qatar, expected go live. Angola, e-invoicing extends to every general and simplified regime VAT taxpayer. Turkey, simplified method traders must issue every invoice as e-Arsiv. Nigeria, enforcement for medium taxpayers. New Zealand, government agencies require e-invoices from suppliers above NZD 33m.
12LifecycleWindows 10 Enterprise LTSC 2021 leaves support. The IoT edition of the same build loses mainstream support the next day, 13 Jan 2027, and keeps security updates until 13 Jan 2032.
Feb 2027
01FiscalGreece, exclusive use of an e-invoicing provider or the state apps required for the businesses that joined 2 Nov 2026. Saudi Arabia, ZATCA wave 25 integration deadline, for taxpayers above SAR 187,500.
Mar 2027
01FiscalArgentina, sellers outside VAT must issue electronic receipts only, with no fiscal controller option.
Apr 2027
01FiscalOman, Fawtara phase 1 for supplies above OMR 5m, moved back from February, consumer sales included.
Jul 2027
01FiscalSpain, VeriFactu wave 2. Belgium, GKS 2.0 migration wave 1: registers purchased up to 31 Dec 2017. UAE, SMEs. Nigeria, emerging taxpayers go live.
Sep 2027
01FiscalFrance, SMEs and micro enterprises must issue e-invoices and meet e-reporting.
Oct 2027
01FiscalOman, Fawtara for every remaining taxpayer, supplies of OMR 5m or less. UAE, government entities go live.
Dec 2027
31GS1GS1 Sunrise 2027, retail POS should read and process 2D barcodes. GS1 Nederland words this as a commitment retailers have made, not an obligation on them.
Jan 2028
01FiscalNigeria, enforcement for emerging taxpayers, under NGN 1bn turnover.
Apr 2028
01FiscalSingapore, GST InvoiceNow for new compulsory registrants and existing registrants with supplies up to S$200,000.
Jul 2028
01FiscalBelgium, GKS 2.0 wave 2. Hungary, hardware e-cash registers become mandatory.
Oct 2028
01FiscalJapan, the transitional credit on purchases from unregistered suppliers falls from 70 to 50 percent.
ViDA sets the far horizon in Europe. The VAT in the Digital Age package entered into force on 14 Apr 2025 and already matters, because it lets member states mandate domestic e-invoicing without a Council derogation, which is why France, Poland, Croatia and Belgium all moved at once. The dates that bite later: digital reporting for intra-EU B2B on 1 Jul 2030, and 1 Jan 2035 as the convergence deadline by which existing national systems must align with the EU standard. ViDA targets cross border B2B, so domestic B2C till receipts stay a national competence. Nothing equivalent exists globally: outside the EU every regime on this page is its own sovereign design, which is why the till work does not generalise.
Checked at source 1 Nov 2026 at 11:11
Field notes
29 notesThings that turned up while we were assembling the rest of this board. We keep them here rather than dropping them, because the awkward details are usually the ones that cost someone a day.
Things that are not what they look like
Windows
The same build, five years apart
Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021 are both build 19044 and take the same monthly KB. The desktop SKU ends 12 Jan 2027 on a five year lifecycle. The IoT SKU is on a ten year one, but Microsoft's own lifecycle page ends its mainstream support at the same point, 13 Jan 2027; only extended support, which means security updates, runs on to 13 Jan 2032.
A migration plan built on the wrong SKU is off by five years in either direction, and the build number does not say which one a lane carries. Even on the IoT SKU, everything except security updates stops in January 2027.
Drivers
An OPOS driver with no version of its own
One of the scanner OPOS packages on this board ships inside the vendor Scanner SDK installer, so it simply carries the SDK version, and its OPOS documentation page redirects to the SDK release notes for version detail.
Asking a site what version of the OPOS driver is installed is really asking what version of the SDK is installed.
Drivers
Two sources, one driver, two versions
For the Datalogic JavaPOS package the download portal and the developer documentation site still do not agree: the drivers tab row reads the portal's dated entry, 1.14.093 from 14 Jul 2026, while the docs site continues to lag behind it, undated as before. The specific figures move as Datalogic ships; what does not change is that the dated portal entry wins.
The dated portal entry wins, but anyone checking the docs site first will conclude the estate is ahead of current.
Drivers
One driver name, a version per model
The Advanced Printer Driver 6 is versioned per printer model rather than globally. The TM-T88VII build is 6.10 from June 2025; the TM-m30III build is still 6.07R1.
There is no single APD version to standardise on, so a fleet baseline has to be expressed per model.
Windows
A known issue can be filed on a page the lane never reads
The Remote Desktop Services issue opened on 11 Sep 2026 listed Windows 10 Enterprise LTSC 2016, LTSC 2019, 21H2 and 22H2 among its affected platforms, but it was filed on the release health page for 1809 and Server 2019. When this note was first written, the 21H2 page, which covers both LTSC 2021 SKUs, showed no open issues at all. That page later caught up: read on 11 Oct 2026, it carried the RDS entry alongside the other September issues. Read again on 25 Oct 2026, it lists two issues only, USB audio and a resolved Defender notification, and the RDS entry has gone. The issue itself was resolved on 14 Sep 2026 by that month's out of band updates.
Checking only the release health page for the build an estate runs can report clear while an issue naming that build sits on another channel's page, and the right page may only list it later. The affected platform list inside an issue is the authority, so all three Windows 10 channel pages are worth reading, not only the one a lane runs.
Security
The remote support flaw that points the other way
CVE-2026-84869 is in the ScreenConnect client, not the server, and it lets files be transferred and executed on the Host system through an active session without confirmation. ConnectWise states servers are unaffected.
Remote management risk is usually modelled as the server reaching down to the endpoint. Here the session is the path back to the support machine, which typically holds credentials for the whole estate.
GS1
Being an imager is necessary, not sufficient
GS1's own implementation guideline says plainly that not all imaging scanners will be capable of the 2027 goal. The real bar includes reversed reflectance handling and a decode inside 300 ms on a bioptic.
A scanner that reads a QR code on the bench can still miss the latency budget at lane speed. Spec sheet symbology lists do not answer the question.
GS1
A scanner in keyboard mode can read a GS1 code and still lose its separators
Batch, expiry and serial numbers in GS1 DataMatrix, GS1 QR and GS1-128 codes are variable length, so the code separates them with FNC1, which the GS1 General Specifications require a scanner to transmit as the control character GS, ASCII 29. No key types it. A scanner set up as a USB keyboard has to send it as a key combination, and Zebra's own character table for the MP7000 lists GS as CTRL ]. What arrives then depends on the application and the keyboard layout: integrator write-ups describe the separator vanishing in keyboard mode, and a GS1 parser project reports a scanner on a German layout sending Ctrl and + instead, which a browser reads as zoom. GS1's own specification warns that some receiving systems turn GS into something else. Zebra's MP7000 guide offers a USB keyboard FN1 substitution for GS1-128 only, off by default, and Zebra's other guides give Enter as the default substitute keystroke.
Without the separator, a batch number runs straight into the expiry date behind it. A lane whose scanner types into the till as a keyboard is worth testing before Sunrise 2027 with a real GS1 DataMatrix carrying batch and expiry, not only a QR code. Modes that hand the application data rather than keystrokes, OPOS over the scanner's USB POS mode or a serial COM mode, do not depend on a keyboard layout at all.
Firmware
A dead scanner may be a cradle that will not repair
Zebra names DS2278, DS3678, DS8178, LI4278 and CS6080 together in its own support article 000026226, and DS3678 and LI3678 again in article 000027722, both for a scanner that will not connect to its cradle or host, described as low beeps with a red Bluetooth indicator. Both articles sit behind a script rendered support portal that returned no readable body to a plain fetch, so this rests on their titles and Zebra's own numbering naming the same models for the same symptom, not on the article text. An independent installer report on the PLCtalk forum describes the identical four beep, red light failure on a DS3678 and STB3678 cradle, cleared only by power cycling the cradle rather than by anything done to the scanner itself.
DS2278, DS8178 and LI4278 are all on this board's firmware tab, and each shares a cradle with another model in its family. A lane reporting a dead scanner is worth a cradle power cycle before a replacement order.
Drivers
An AnyCPU build can make an OPOS device disappear rather than fail
OPOS service objects for scanners, printers and scales exist only as 32-bit COM objects, whichever vendor ships them. Microsoft's own POS for .NET documentation states that an application built to the default AnyCPU platform runs as a 64-bit process on 64-bit Windows, and a 64-bit process cannot load a 32-bit OPOS object as an in-process COM server: the device is not reported missing or faulted, it is simply not visible to the application. The documented fixes are to compile the executable as x86 or anycpu32bitpreferred, or to re-register the OPOS object for an out of process COM surrogate, which Microsoft supplies a PowerShell script for. The kunif/OposInternals reference project, written for people building the service objects rather than the applications that use them, independently names the same COM registration limit and advises against AnyCPU builds altogether.
A newly built or upgraded POS for .NET application that suddenly cannot see a scanner or printer Device Manager still lists as present is a build platform question before it is a cabling or driver one, for any OPOS device on this board.
Drivers
The standard moved to 1.16, the Windows drivers stayed at 1.14
The Object Management Group, which owns UnifiedPOS, lists 1.16.1 as the current formal version, published July 2022, after 1.16 added retail service robots in June 2021. Nothing on Windows implements either. The OPOS common control objects from Monroe Consulting Services, the set Microsoft tests Dynamics 365 Commerce against, stand at 1.14.001, dated 7 Feb 2015, supporting OPOS 1.01 through 1.14.1, and Monroe's own UnifiedPOS page ends at 1.14.1. Microsoft's POS for .NET 1.14.1 download, republished 15 Jul 2024, calls itself a fully compliant implementation of UnifiedPOS 1.14.1 and lists Windows 11, Windows 10, POSReady 7 and Embedded Industry 8.1. Of the OPOS and JavaPOS levels on the drivers tab, the ones numbered after a UnifiedPOS release are 1.14 builds: Epson's 1.14.38 and 1.14.37, Datalogic's 1.14.211 and 1.14.093, Citizen's 1.14.1.10 and 1.14.0.5, HP's receipt printer package 1.14.1.12 and Newland's v1141; Zebra's driver is built on CCO 1.14.1, and HP's USB cash drawer package, from 2016, reads 1.13.5. The rest, Bixolon's and NCR Voyix's among them, use the vendor's own numbering, which does not say which UnifiedPOS release they implement. None reads 1.15 or 1.16. A 1.16 control object set exists on GitHub as a community port of Monroe's code, not a vendor or Microsoft release. Read 21 Oct 2026.
A feature read from the 1.15 or 1.16 specification is not reachable through any driver on this board that states its UnifiedPOS level, and a service object that reports 1.14 is current, not behind. A control object set reporting 1.16 on a lane came from a community build, which is worth knowing before a support call to the scanner vendor.
Drivers
A POS upgrade can add an OPOS dependency the lane never had
Microsoft's Dynamics 365 Commerce documentation states that the Store Commerce app does not support Universal Windows Platform peripherals, the Windows Point of Service devices that Modern POS could use without a vendor driver. A USB scanner or magnetic stripe reader that ran in plug and play mode has to get an OPOS driver installed and a hardware profile entry before it works with Store Commerce. Microsoft deprecated Modern POS and the Retail hybrid apps in October 2023 and recommends Store Commerce for every new deployment, with existing customers to migrate. Its Store Commerce FAQ adds what deprecated means here: no Modern POS version has been released since October 2023, an existing install keeps running, but Microsoft gives no support or updates for problems on it, and support for sealed Modern POS ended the same month. No removal date is published. The same documentation names Monroe Consulting Services' common control objects as what Commerce is tested against, places OPOS registration under WOW6432Node on 64-bit Windows, requires .NET Framework 4.8 for the embedded hardware station from Commerce 10.0.42, and lists Windows 10 IoT Enterprise LTSC among the supported editions. Read 21 and 22 Oct 2026, pages dated 20 Feb, 20 Aug and 23 Sep 2026.
A lane that scanned for years on Modern POS with no vendor driver installed is the one that stops scanning after the migration, and Device Manager shows nothing wrong. The answer is the vendor's OPOS service object from the drivers tab, 32-bit, plus a profile entry, not a replacement scanner. The AnyCPU note on this tab applies the moment an OPOS driver enters the picture.
Firmware
A printer firmware update can change the name the printer answers to
Zebra's Link-OS 7.6, released 10 Apr 2026, moved what a Link-OS printer registers in DHCP and DNS from device.friendly_name to a new ip.hostname setting, for Microsoft's Windows Protected Print. ip.hostname defaults to the product name and serial number, so a printer that registered under a custom friendly name stops answering to it, and Zebra warns that print jobs routed by name can fail. Link-OS 7.6.2, 19 Jun 2026, copies a valid custom friendly name across once, on its first boot. The same 7.6 release turns FTP and HTTP off by default on new printers and on upgraded printers still on factory settings or reset to them. And 7.6.2 lists a known issue: on Windows 10 PCs with Intel processors older than the Core i5 7500 series, the printer may fail to enumerate over USB.
Three different symptoms from one firmware push: a label printer that no longer prints by name, a printer web page or FTP upload that no longer answers, and a USB printer missing from an older Windows 10 lane PC. Going straight to 7.6.2 or later rather than 7.6 or 7.6.1 carries a custom name across only when it is already a valid DNS name; one with spaces or other characters has to be set in ip.hostname by hand, and from Link-OS 7.7 (25 Sep 2026) the printer refuses such a name when it is saved, while a name built from a macro has its invalid characters replaced with hyphens. A provisioning script that names printers with spaces or symbols needs changing before a fleet goes to 7.7. The USB issue is worth a test on the oldest lane PC before a fleet push, and the firmware row on the firmware tab carries the current V93 build for the ZD421 and ZD621.
Numbers worth distrusting
GS1
The GS1 readiness statistics are six years old
The figures that circulate in Sunrise 2027 presentations, 84 percent of retailers planning a migration and 68.5 percent still on laser scanners, come from a GS1 US and VDC study published in March 2020.
They are quoted as though they describe today. No GS1 readiness survey for 2025 or 2026 could be found at all.
GS1
There is no public scoreboard
No GS1 published survey measures how many tills can read 2D at the point of sale. Two retailers are now named and live: Tesco replaced the linear barcode entirely, not dual marked, with a single QR code powered by GS1 on its own-label sausage range, 13 lines, from April 2026, confirmed by Tesco's own supply chain development and change director and by GS1 UK's chief executive. Carrefour followed by May 2026, with QR codes powered by GS1 on 50 private label products, confirmed by GS1's own case study and by its Global and France Chief Digital Officer, named in independent trade coverage; no source found states whether the linear barcode was removed or kept alongside it. The only broader current figure found anywhere was fewer than 20 percent of Amazon brand partners actively planning, described in its own source as one person's informal poll.
Two named, confirmed retailers live with 2D at POS is still not a scoreboard. Tesco went QR-only; Carrefour's rollout does not say either way on that point. Any wider 2026 global adoption percentage should still be met with a request for the source.
GS1
The list of ready vendors was wrongly read as empty
GS1 publishes solution provider 2D readiness criteria and invites vendors to have their status listed. Corrected 14 Sep 2026: the list is not empty. Read live from gs1.org it names 32 companies across four categories, six of them under POS Scanner, including Datalogic, Zebra, Honeywell and Newland AIDC, already vendors on this board.
It is self attestation rather than certification, published by GS1 with no warranty of accuracy, so a listing is a claim worth putting to the vendor directly rather than a conformance statement.
Rules with a sting in them
Fiscal
Albania starts at the first sale
Fiskalizimi has no turnover threshold whatsoever, covers B2C including card payments, and caps offline operation at 48 hours. The tax administration states explicitly that a generic ERP connector or a Peppol access point is not sufficient.
Most market entry strategies assume a small merchant exemption to grow into. There is none here.
Fiscal
Colombia puts the tax authority on the critical path
The electronic equivalent document for POS sales must be pre-validated by DIAN before the receipt is handed to the customer. Paper contingency exists but must be transmitted within 48 hours.
Authority latency becomes checkout latency. This is an availability requirement, not just an integration.
Fiscal
Taiwan will not let the till mint an identifier
Invoice numbers for the electronic government uniform invoice are allocated centrally by the ministry. The POS draws from assigned number blocks rather than generating its own.
Number block inventory becomes a thing the POS has to manage and can run out of, which most architectures have no concept of.
Fiscal
Malaysia's rule that actually bites
Consumers who do not request an e-invoice are covered by a periodic consolidated one. From 1 Jan 2026 consolidation is prohibited for transactions above RM10,000.
The threshold turns a back office batch job into a decision the till has to make at the moment of sale.
Fiscal
South Korea issues whether or not the customer asks
In designated sectors a cash receipt must be issued automatically at KRW 100,000 and above, with an approval number fetched from the tax service, regardless of whether the customer requests one. Failure in a mandatory sector carries a 20 percent penalty.
The till needs a buyer identifier it was never designed to ask for, on a transaction the customer thinks is anonymous. When the customer gives none, the receipt is still owed: the seller self issues it to the National Tax Service's own code number within five days.
Fiscal
A VAT rate change as a firmware project
When Russian VAT moved to 22 percent on 1 Jan 2026, the tax service acknowledged that till firmware and software updates would take three to four months and instructed inspectors not to inspect during the first quarter.
Where a secure element sits inside the till, a tax rate is not configuration. It is a release.
Fiscal
Norway regulates the supplier, not the shop
Under Kassasystemlova the cash register supplier files a product declaration with the tax authority, and only declared systems may be used. The system must have an electronic journal, produce X and Z reports, export signed SAF-T Cash Register, and have no delete function at all.
It is the one obligation on this board that lands on the software vendor rather than the retailer, and it is in a market usually assumed to be unregulated.
Firmware
A scanner scale is verified against its scale, not its scanner
Datalogic's own OIML certificates name the legally relevant software inside its scanner scales by ID. For the Magellan 9300i and 9400i, with a Mettler-Toledo load cell, the IDs are 1-70-28 and 2-0-0, and the EEPROM, calibration switch and load cell sit under a tamper evident seal (certificate R76/2006-A-GB1-19.07, 26 Apr 2019). For types 9621, 9622, 9921 and 9922, the numbers that open 9600i and 9900i part numbers, they are weighing 2-14 and signal processing 2-00-17 (certificate R76/2006-A-DK2-2022.08, 3 Oct 2022). Holding Scale Zero for about five seconds puts the scale into diagnostics, and the platter's 7-segment display scrolls the calibration counter, the load cell checksum and those IDs three times before the scanner resets. Mettler Toledo also sells its own Ariva-B weighing module for the 9550i, 9600i and 9900i, approved separately (OIML, NTEP, CE) and installed by its own technicians. An OIML certificate is not itself a national approval, and the approval in force in each country is the one that counts.
The DR release on the firmware tab is a scanner level; the weighing side answers to the IDs on its approval. A diagnostics read before and after a Magellan firmware rollout shows whether the scale still matches what was verified, and a mismatch or a moved calibration counter is a question for the verifier, not a lane setting. Which approval applies depends on whose scale sits in the bioptic, Datalogic's or Mettler Toledo's.
Quietly unfixable
Security
Receipt printers answer to anyone
ESC/POS over TCP port 9100 has no authentication or encryption by design. Any host that can reach a networked Epson TM printer can send it commands. There is no CVE, no firmware fix, and none is coming: Epson's guidance is network isolation.
The whole TM line in a typical estate is an unauthenticated command endpoint. It is an architectural property, so it will never appear as a patchable finding.
Firmware
Firmware that only changes a font
The most recent releases for the Epson TM-T88VII and TM-T88VI were both Thai font redesigns, with no bug fixes and no security content.
Worth reading the release note before scheduling a fleet wide update that carries risk and delivers nothing to most estates.
Firmware
A feature that quietly disables another
Epson TM-T88VI firmware 40.60 added automatic CA signed certificate updates. Enabling it stops the printer entering power saving mode.
Buried in a release note, and the symptom appears as a power or heat complaint months later rather than as a certificate problem.
Firmware
Firmware that cannot be looked up
For one scanner line the firmware build strings appear only inside the configuration application and in quarterly release notes that most fetchers other than this box cannot reach. In counter scanner firmware from Datalogic was once thought to sit behind a partner login; since 20 Sep 2026 it is read from Aladdin, the vendor's own configuration tool, whose repository turns out to be public and unauthenticated.
Eleven rows on the firmware tab read Not verified as of 1 Nov 2026, and the reasons differ: a sign in gate (Honeywell, Diebold Nixdorf), an HP printer whose pages will not render outside a browser (Value Receipt Printer), an HP terminal for which HP's own SoftPaq catalogue serves no reference file (Engage One Essential), a discontinued scanner no current note covers (DS9808), four payment terminal vendors that publish no firmware catalogue at all, and a scale module whose maker publishes no firmware level (Mettler Toledo Ariva-B). Not verified means the figure could not be read at a source, not that it is old.
Windows
Ten years old, and out of support since 13 Oct 2026
Windows 10 IoT Enterprise LTSC 2016, build 14393, was released in August 2016 and left support on 13 Oct 2026, ten years and two months later. Past that date it gets security updates only through Extended Security Updates bought from the device manufacturer. The IoT releases that followed it run on: LTSC 2019, build 17763, to 9 Jan 2029, and LTSC 2021, build 19044, to 13 Jan 2032, with security updates only after 13 Jan 2027.
The ten year IoT lifecycle meant a decade old build could still be fully patched, and an estate that ran it had ten years to forget it was there. A lane still on build 14393 today is unpatched unless someone enrolled it in ESU.
Work log
159 entriesWhat we changed on this board, why, and what the change rests on. Each entry says how sure we are: confirmed at a source, a strong indication from several, or a speculative lead worth recording.
Showing 11 of 159
- 2 Nov 2026SecurityConfirmedZebra published a second alert in a week, and its all clear is conditional on connectivity
What changed
Zebra's LifeGuard security alerts page carries 15 entries, the newest being the compromise of eight eMudhra intermediate certificate authorities, dated 27 Oct 2026. Zebra states that its printers, fixed RFID readers, machine vision systems and barcode scanners do not use the affected chains, and that no manual remediation is needed for standard, internet connected deployments. The advisory item now carries the exception Zebra gives for a device that cannot reach Google Play Services or a restricted network.Why
Two publications in seven days confirm the channel is live after four years and ten months, which this board described as dormant until the last sweep. The conditional all clear is the half that matters for a checkout, because the devices a store deliberately keeps off the internet are the ones the automatic fix never reaches. - 2 Nov 2026CorrectionConfirmedThree fiscal Next columns were showing a date that had already gone by
What changed
The Next column sweep found Argentina, Costa Rica and China all still reading 1 Nov 2026, a day after it passed. Argentina now reads 1 Mar 2027, the date its own row and the estate calendar already carry for sellers outside VAT. Costa Rica and China now read in force, because the obligations their rows describe, the v4.4 annex update and the Leqi e-fapiao requirement for retail fuel stations, started on that date.Why
The Next column means a date a till has to be ready for, so a date in the past in that column reads as a deadline still to come. This is the cheapest check on the tab and it is the third review in a row where it earned its place. - 2 Nov 2026CorrectionConfirmedThe Secure Boot certificate item overstated what a cumulative update cannot do
What changed
The dated Secure Boot card said that moving to the 2023 certificates is a firmware level change and not something a cumulative update does on its own. Microsoft's own article says most devices receive the certificates automatically through Microsoft managed updates, and the October cumulative says that rollout through Windows Update continues to eligible devices. The card now carries that, and keeps the part that is still true: some devices need an OEM firmware update first, and such an update may only be available while the device is still in support.Why
The original wording would send a reader to the hardware vendor for every device, when for most the change arrives on its own. The OEM dependency is real but narrower, and the support period qualification is the sentence that matters for old lane hardware. - 2 Nov 2026SecurityConfirmedHP has no Intel Graphics fix level for the first generation Engage One Pro
What changed
HPSBHF04085 reached Rev. 4 on 28 Oct 2026 and updated its retail rows. The HP Engage One Pro AIO System and the Engage Go Mobile System are listed with a minimum version of Pending and no SoftPaq. The three CVEs, CVE-2025-32092, CVE-2025-32453 and CVE-2025-32739, are registered with every level HP does publish.Why
A lane on the first generation Engage One Pro has nothing to install for this bulletin, nine months after it was first published, and no page says so in one place. All three issues are local and rated Medium or below, which is why the row explains the reach rather than leading on the score.Evidence
- 2 Nov 2026SecurityConfirmedBrotli decoder flaw registered, with the condition that decides whether POS software is exposed
What changed
CVE-2026-111497 is an out of bounds write in the Brotli decoder, exploited and due at CISA on 10 Nov 2026, and it now has a register row and a pinned attention item. The row gives the fix levels for Brotli, Node.js and .NET, and says what Microsoft says has to be true before an application is exposed at all.Why
An upstream compression library reaches a store the way PHP2Shell did, through software nobody thinks of as a web server. The exposure is conditional rather than universal, and the condition is the useful part: .NET Framework is not affected, and .NET 8 and later decompress Brotli only where an application asked for it. kev.py cannot see this entry at all, because its watchlist has no line for an upstream library. - 2 Nov 2026CorrectionConfirmedAn out of band Windows update did follow the October cumulative, and the board said none had
What changed
The Windows tab claimed no out of band update had followed in October. Microsoft published three on 26 Oct 2026: KB5134125 at 19045.7811 and 19044.7811, KB5134124 at 17763.9378 and KB5134123 at 14393.9615. All are non security and carry an updated trusted root certificate payload. The tab now names them, keeps the distinction between the final security update for 1607 and this one, and carries an open issue on who needs them.Why
Microsoft states that these exist for devices that do not receive current certificate trust list updates: a disconnected environment, a device that cannot reach its certificate update service, or one where automatic CTL updates are off. A lane on a segmented store network is all three, so the vendor assurances that no action is required do not reach it. - 1 Nov 2026CorrectionConfirmedThree more places read as the record of one estate, in a grammar the check could not see
What changed
The 30 Oct sweep took ten strings off the board that spoke as the owner of one particular estate, and the pattern it left behind catches the possessive forms. It does not catch a preposition and the definite plural, which is how three more were written. The Epson ESC/POS advisory placed the affected TM line inside one holding of printers; the PDQ Deploy card called lanes the least physically secure domain joined machines of one; the GS1 scoreboard note measured 2D readiness over one. The advisory now names the model families, the PDQ card reasons from what a lane is rather than from a particular set of them, and the GS1 note asks how many tills can read 2D at the point of sale. A fourth, the heading over the dated cards on the page, framed those deadlines the same way and now reads Dated deadlines; that one is page code and ships separately. house_rules.py carries the second form from today, so board_edit.py and set_note.py refuse it and the quality check finds it.Why
The decision of 30 Oct was that a fact only true in one place is not worth publishing, and these three were exactly that: a reader running tills somewhere else learns nothing from how many printers stand in somebody else's shops. The grammar is the useful part of the finding, because the first pattern read as thorough and was not. Subject forms are deliberately left alone, so "the lanes carry it" and the masthead's "what level the lanes are on" still stand: those read as the lanes of whoever is reading. - 1 Nov 2026Board structureConfirmedRow notes stop recording when the row was added
What changed
Eight hand written row notes opened with "Added for relevance", most of them saying the vendor or device was not previously in the lanes or on the board: Toshiba Tec TCx 900, Diebold Nixdorf BEETLE M2110, PAX, Verifone, Ingenico, Mettler Toledo Ariva-B, NCR Voyix CX7 and Citizen's OPOS driver; the CCV row lost the same phrase in today's entry on its certification date. That is a record of when the board grew, which the work log already keeps, and three of them spoke of the lanes as one estate's. Each now starts with the fact about the device. The Honeywell row's download gate check date moves to 30 Oct 2026, the latest weekly read, which found the same Honeywell sign on. No figure, status or date moved.Why
The board is for anyone running tills, decided 30 Oct 2026. A reader gains nothing from knowing which rows arrived late, and the first words of a note are the ones a reader scanning the tab actually reads. - 1 Nov 2026CorrectionConfirmedField notes: the UnifiedPOS note overstated how many drivers name 1.14, and the Korea note gains the no identifier case
What changed
The note "The standard moved to 1.16, the Windows drivers stayed at 1.14" said every OPOS and JavaPOS level on the drivers tab is a 1.14 build. The drivers tab itself does not bear that out. Bixolon's OPOS V5.2.10 and JavaPOS V2.8.12, NCR Voyix's NCRPSW 5.x packages, Epson's OPOS ADK 3.00E, Newland's OPOS v120 and three of HP's OPOS packages are numbered on the vendor's own scheme and say nothing about a UnifiedPOS release, and HP's USB cash drawer package reads 1.13.5. The note now names the levels that do carry a UnifiedPOS number, all 1.14 apart from that HP package, and says that none on the tab reads 1.15 or 1.16, which is what its conclusion rests on. The South Korea cash receipt note said the till needs a buyer identifier; it now adds what the National Tax Service says happens when the customer gives none: the seller self issues the receipt to the NTS code number within five days, as the Fiscalisation tab has said since 31 Oct. Two smaller fixes: the Datalogic note pointed at a row above that sits on another tab, and the Not verified count, still eleven, now reads as of 1 Nov 2026. Every note on the tab was read this run.Why
A field note that claims more than the board beside it shows teaches a reader to distrust both. The UnifiedPOS conclusion still holds for every driver that states its level, and no further; the Korea note as written read as though an anonymous cash sale could not be receipted at all. - 1 Nov 2026CorrectionConfirmedCorrection: no source says most NCR Voyix self checkout lanes run the SelfServ 90
What changed
The 30 Oct entry adding the SelfServ 90 Rel 2.x BIOS row said the SelfServ 90 is the self checkout unit most of NCR Voyix's installed base runs, and the row note opened with the same claim. Neither the entry nor the run behind it cites a source for that: the two NCR Voyix support pages it rests on give the BIOS link and the BIOS releases, not a share of the installed base, and no other source for it is on record. The sentence is taken off the row, and the SelfServ XK7 row no longer calls the SelfServ 90 the core that matters more. The BIOS figures, the Kaby Lake restriction and the DMI utility warning are unchanged. The original entry is left as written.Why
A claim about what is deployed needs two independent sources before it goes on the board, and marketing copy is not one of them. This one had none, and it reads as the reason the row is there, which a reader would take at face value. - 1 Nov 2026LifecycleConfirmedCCV's VX520, VX820 and VX680 are past their 31 Oct 2026 certification end
What changed
The row for the CCV VX520, VX820 and VX680 said they were certified up to and including 31 Oct 2026 and had to be replaced before then. That date was yesterday. CCV's own replacement pages for the Netherlands and Belgium, read 1 Nov 2026, still give 31 Oct 2026 as the date the certification runs out, still name the same three models, and say nothing about a terminal still in use after it. The row now carries a Certification ended chip and reads in the past tense.Why
A row telling a reader to replace a terminal before a date that has already gone reads as though there is still time. CCV has not moved the date, so the board states that it has passed rather than waiting for the next lifecycle pass.
Sources, and how to read this board
Windows lifecycle and servicing IoT Enterprise release history · Lifecycle, Win11 IoT LTSC 2024 · Lifecycle, Win11 Enterprise LTSC 2024 · KB5126657 · Known issues, LTSC 2021 · Known issues, LTSC 2019 · Known issues, LTSC 2016
Epson Release note PDFs on download3.ebz.epson.net and the newer download-center.epson.com. The portal index pages are blocked by robots, the ov_*.pdf notes are not, and each carries version, upload date and changelog. Advisories at wa00971, wa00977, wa00828.
Zebra Two machine readable sources, no scraping in either. Software: techdocs.zebra.com, whose /about/ pages carry version history tables. Firmware: the quarterly Evolution Update notes. Those notes are fetchable; an earlier reading that they were not came from testing off site, where the CDN answers 406. Their urls are discovered from the json feed behind that page, because the filenames and directories have changed repeatedly and cannot be constructed. Note that an older release notes page also exists but stops at version 3.0 from 2016, so it is not a usable source.
Datalogic and HP Datalogic software downloads, server rendered, so a plain GET reads all 68 entries and the category query string is only a client side filter. In counter firmware is not published there or anywhere else on the open web, re-checked 13 Sep 2026. HP ships OPOS as separate per peripheral SoftPaqs, each with its own version, read through the HPCMSL reference file.
GS1 Sunrise 2027 2D at Retail POS Implementation Guideline · POS Host and Backend Systems Playbook · Capability test suite · Solution provider readiness · GS1 Nederland. Note the gs1.nl site has been restructured and several stappenplan URLs now 404.
CVE register CISA KEV catalogue · JVNTA#97995322, ESC/POS · Epson security notifications index · ZDI Patch Tuesday review · CERT/CC VU#164934 · ConnectWise ScreenConnect bulletin, 8 Sep 2026 · Horizon3 on Simphony. Windows affected build lists were taken from the CVE Program records filed by Microsoft on 8 Sep 2026, not from a summary.
Fiscalisation, Europe GKS 2.0 Belgium · economie.gouv.fr on caisse certification · AADE Greece · Skatteetaten Norway · EU ViDA adoption · Keurmerk Afrekensystemen
Fiscalisation, rest of world ZATCA wave 25 · SUNAT Peru · Revenu Quebec · IRAS Singapore · eGov Kazakhstan · SARS consultation. Where no tax authority page was reachable, the entry rests on a big four alert or a fiscalisation specialist, and anything that could not be confirmed says so in the row.
How to read this board Every version here was taken from a vendor page or release note, with the date that page showed. A Not verified chip means the vendor does not publish the figure publicly and it was left blank rather than guessed. Fiscal entries state the position as of 12 Sep 2026; confirm against the primary text before committing engineering work.
Opticon, Newland and Honeywell Opticon downloads is the most open source of the four scanner vendors: one server rendered page, a firmware level for every current model, no login. Newland software and drivers are public direct links whose versions come from the link label or the filename; only its Ndevor device management portal needs a login. Honeywell publishes nothing readable: every route ends at hsmftp.honeywell.com behind a sign in.
We read every version here from a vendor page or release note, and we publish this board because most of it is just as true for anyone else running tills. Where we cannot confirm a level at source we mark it Not verified rather than estimating it. Talk to us about a POS estate →
We publish this in good faith and check it at source, but vendor pages move and regulations change: we cannot warrant that everything here is complete or current, and Tillforge accepts no liability for decisions taken on the basis of this page. Anything acted on should first be confirmed with the vendor or the relevant authority. See our terms.