Live vendor data
Toonbank
What leaves support, what driver and firmware level the lanes are on, and which fiscal rule lands next. We keep this board for our own POS estate and publish it because most of it is just as true for anyone else running tills.
Scope: Epson, Zebra, Datalogic, Opticon, Newland, Honeywell, HP
47 of 55 figures confirmed at source
Vendor levels checked 15 Sep 2026 at 16:07
Dated across the estate
1 day overdue
CVE-2026-84869, ConnectWise ScreenConnect, is exploited in the wild. CISA due date 14 Sep 2026.
Added to KEV 11 Sep. CVSS 9.9. The client is affected, not the server: fixed in 26.6.5.
7 days
CVE-2026-85880, Windows ALPC, is exploited in the wild. CISA due date 22 Sep 2026.
Local escalation to SYSTEM. Hits LTSC 2016, 2019 and 2021. Fixed in the September updates.
15 days
Greece: notify AADE of the myDATA issuing route by 30 Sep 2026.
Certified provider (EDIP) or the free state apps. Phases follow on 1 and 12 Oct.
28 days
Windows 10 IoT Enterprise LTSC 2016 leaves support on 13 Oct 2026.
That Patch Tuesday is its last free update. IoT ESU is sold through hardware vendors only.
Checked at source 14 Sep 2026
Windows LTSC runway
Microsoft LifecycleWe verify these against Microsoft's own end of support index pages on learn.microsoft.com (end-of-support-2026, -2027, -2029, -2032, -2034). All six agree except Windows 11 Enterprise LTSC 2024, which we correct here from 10 to 9 October 2029.
elapsed
remaining
under 6 months
under 2 years
over 2 years
The IoT editions are not the desktop editions. Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 are the same 19044 build, but the IoT SKU carries a 10 year lifecycle and the desktop SKU carries 5. A lane imaged with IoT Enterprise LTSC 2021 is good until January 2032; a lane imaged with plain Enterprise LTSC 2021 stops in January 2027. Confirm the SKU per lane before planning either as one migration.
September servicing, all three Windows 10 LTSC channels
| Channel | Update | Build |
|---|---|---|
| LTSC 2021 / 21H2 | KB5122878 | 19044.7725 |
| 22H2 (non LTSC) | KB5122878 | 19045.7725 |
| LTSC 2019 / 1809 | KB5122876 | 17763.9245 |
| LTSC 2016 / 1607 | KB5123099 | 14393.9512 |
- Released
- 8 Sep 2026, still current five days on. No out of band release, including for the RDS issue below.
- Next
- Patch Tuesday 13 Oct 2026, the same week LTSC 2016 expires.
Open known issues
Extended Security Updates now exist for LTSC 2016, and the IoT edition buys them from the hardware vendor, not from Microsoft. New
Microsoft's Windows IT Pro blog Plan for Windows Server 2016 and Windows 10 2016 LTSB end of support, published 20 Feb 2026 and last updated 21 Apr 2026, confirms end of support on 13 Oct 2026 for both Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise LTSB 2016, and offers ESU for up to three years beyond it. The two editions are bought through different channels. Enterprise 2016 LTSB ESUs went on sale through Volume Licensing on 1 Apr 2026. ESUs for IoT Enterprise LTSB 2016 are available only through IoT OEMs, so for a lane the route is the device manufacturer, not a Microsoft volume agreement or a reseller quote. Price doubles each consecutive year and the years are cumulative: enrolling in year two means paying for year one as well. ESU carries critical and important security updates only, and explicitly does not extend technical support. Read 14 Sep 2026.
Remote Desktop Services may stop responding after the September update. New, mitigated
Opened 11 Sep 2026, last updated the same day. Originating update KB5122876, build 17763.9245. RDP connections fail after several minutes, sign in fails, and machines hang at "Please wait for the Remote Desktop Configuration". MMC, the RDS Licensing Diagnoser, File Explorer and the Windows Update page can go unresponsive with it. The affected list names Windows 10 Enterprise LTSC 2016, LTSC 2019, 21H2 and 22H2 as well as the Server editions, so this is not a server only problem. The only mitigation Microsoft states is stopping and restarting an affected virtual machine to restore connectivity, which is no help on physical lane hardware. Relevant where a lane accepts inbound RDP for support access.
The LTSC 2021 / 21H2 channel page still lists nothing open. Read with care
That page was last revised 14 Aug 2026 and shows only resolved entries: the Recycle Bin $Rxxxxx.ext delete dialog bug and the WSUS sync timeouts. The RDS issue above names 21H2 among its affected platforms but is filed on the 1809 and Server 2019 page, so a lane on 21H2 can be affected by an issue its own channel page does not carry.
False "Microsoft Defender Antivirus is turned off" notifications. Confirmed
Last updated 28 Aug 2026, not tied to a KB. Defender is running and every setting reads as active. The toast appears at sign in and intermittently after, and persists with notifications switched off. Microsoft lists every Windows and Windows Server version on current Defender platform updates, so this is not LTSC 2019 only. Fix is coming in a future Defender platform update. Verify protection state centrally, not from the toast.
Checked at source 15 Sep 2026 at 16:07
OPOS and UPOS driver levels
23 confirmedWe measure age from the vendor's own published release date. For Newland that date is the file's Last-Modified header, which is an upload stamp rather than a release: three of its drivers carry the same one within three seconds of each other, so read those ages as a site migration and not a shipment.
| Package | Version | Released | Age | Note |
|---|---|---|---|---|
| Epson | ||||
| OPOS ADK | 3.00E R27 | 26 Jun 2025 | 15 mo | Compliant with the Radio Equipment Directive. |
| JavaPOS ADK (Windows) | 1.14.38W | 26 Jun 2025 | 15 mo | Same RED release train as OPOS R27. Epson prints the level as Ver.1.14.38W and the ADK is Windows only, despite what this row used to claim: the Linux ADK is a separate download and is not tracked here. |
| OPOS ADK for .NET | 1.14.37 | 20 Feb 2025 | 19 mo | Signed binaries for Windows 11 Smart App Control. A matching 1.14.38 probably shipped in Jun 2025 but its note could not be surfaced, so this is the last confirmed level. |
| Advanced Printer Driver 6 | 6.10 | 25 Jun 2025 | 15 mo | Versioned per printer model, not globally. 6.10 is the TM-T88VII build; TM-m30III sits at 6.07R1. |
| TM Virtual Port Driver | 8.70c | 22 Aug 2024 | 25 mo | Now a user mode driver, renamed from TMCOMUSB. Separate 8.70b line for TM-S. |
| Zebra | ||||
| Scanner SDK for Windows | 3.07.0009 | 1 Apr 2026 | 5 mo | Installs CoreScanner. Bluetooth pairing fix, Han Xin and Grid Matrix support. Roughly quarterly cadence. |
| OPOS driver, scanner+scale | 3.07.0009 | 1 Apr 2026 | 5 mo | Not independently versioned: it ships inside the SDK InstallShield, so it carries the SDK version. OPOS CCO is at 1.14.1. |
| 123Scan | 6.01.0001 | 1 Apr 2026 | 5 mo | New Staging File Wizard combines firmware and config into one file, useful for rollout tooling. |
| JavaPOS driver (Windows) | 3.07.0008 | 1 Jan 2026 | 8 mo | The documented level, and it lags. The SDK 3.07.0009 notes claim JPOS changes, so the installed binaries are almost certainly 3.07.0009. Expect a false mismatch when the two pages are compared. |
| Datalogic | ||||
| OPOS drivers | 1.14.211 | 19 Jul 2024 | 26 mo | Confirmed twice, on the download portal and the developer docs site. |
| JavaPOS drivers | 1.14.093 | 14 Jul 2026 | 2 mo | Portal entry of 14 Jul 2026, read from the live page. The developer docs at datalogic.github.io lag the portal, so the dated portal entry wins and the disagreement is noted rather than resolved silently. |
| USB-COM driver | 7.1.5 | 17 Jun 2026 | 3 mo | Certified for Windows 10 and 11, MSI only now that the EXE wrapper is dropped. A legacy 6.3.2 branch from 2018 is still listed for pre Windows 10 images. |
| Aladdin configuration | 3.3.1.8 | 26 Nov 2025 | 10 mo | 64 bit, Windows 8 through 11. |
| DLRMUS | 1.0.28 | 1 Jun 2026 | 3 mo | Remote management suite that updates scanner and scale firmware with no OPOS dependency. Listed here because it is the likeliest public route to Magellan firmware levels, through the model list it bundles. |
| Newland | ||||
| OPOS driver | v120 | 9 Feb 2026 | 7 mo | Newland publishes no version string for this download, so the level is the token in the filename, recorded verbatim rather than reformatted. |
| JavaPOS driver | v1141 | 9 Feb 2026 | 7 mo | Filename token again. Very probably 1.14.1, matching the JavaPOS spec level, but Newland does not print it that way and the digit grouping is not published. |
| UFCOM virtual COM driver | 186 | 9 Feb 2026 | 7 mo | Filename token. The USB virtual COM driver, equivalent to Datalogic USB-COM. |
| EasySet configuration tool | 2.03.006 | 2 Sep 2026 | 0 mo | Version taken from the link label, which Newland does print for this one. |
| Nset configuration tool | 3.01.001 | 12 Mar 2026 | 6 mo | Version taken from the link label. |
| HP | ||||
| Line Display T-Series OPOS | 7.0.3.2 | 4 Jan 2023 | 44 mo | sp144415. The only current generation HP OPOS package: covers Engage Go, One, Flex Pro and Essential on Win10/11 and IoT Enterprise. |
| Cash Drawer Port OPOS | 2.2.2.2 G | 25 Apr 2019 | 89 mo | sp95904. Ageing |
| Receipt Printer OPOS | 1.14.1.12 G | 5 Mar 2018 | 102 mo | sp85623. Ageing |
| USB Cash Drawer OPOS | 1.13.5 | 20 May 2016 | 124 mo | sp75252. Ageing |
Driver age is not evenly spread across this table. Several of the OPOS packages here predate Windows 10 IoT Enterprise LTSC 2021 entirely, and the oldest is over ten years old. That is not automatically a defect, OPOS interfaces are stable and an old driver can be a working driver, but it does mean those peripherals on a fresh LTSC image are running code that was never tested against it. Where a configuration guide pins no version numbers, the per package release notes are the only authority, which is why every row here is dated from one.
Checked at source 15 Sep 2026 at 16:07
Device firmware
8 unverifiedWe read Zebra scanner levels from the quarterly Evolution Update notes, which publish a plug-in build as the firmware level with the scanner build as a component inside it, so we show both. A note only lists what moved that quarter, so each level here is the most recent mention across the last eight notes, and we give the quarter it came from per row. Opticon publishes every model openly. Datalogic and Honeywell publish no firmware on the open web at all.
| Device | Level | Scanner build | Released | What it changes |
|---|---|---|---|---|
| Epson | ||||
| TM-T88VII | 63.08 | – | 23 Jun 2025 | Thai font redesign for Font A/B and Special Font A/B. No bug fixes, no security content. |
| TM-T88VI | 40.61 | – | 24 Sep 2025 | Thai font redesign. Worth knowing: the prior 40.60 added automatic CA signed certificate updates, and enabling that stops the printer entering power saving mode. A separate low speed model line sits at 43.58A. |
| TM-m30III | 13.19 | – | 24 Feb 2026 | Fixes a failure in network communication even with the Wi-Fi LED lit. |
| Zebra | ||||
| MP7000 | PAADGS00-006-R05 | CAADGS00-006-R05 | 5 Mar 2026 | Release 43, from the 2026-Q1 note. End of sale was 15 Sep 2025; service and support run to 15 Dec 2030. Expect firmware releases to taper. |
| MP7200 | PAAFES00-005-R01 | CAAFES00-005-R01 | 21 May 2026 | Release 17, from the 2026-Q2 note. Colour camera bug fix. |
| DS9908 | PAAECS00-007-R00 | CAAECS00-007-R00 | 8 Jun 2026 | Release 23, from the 2026-Q2 note. Adds support for Digimarc Gift Card. |
| DS8108 | PAACZS00-013-R01 | CAACZS00-013-R01 | 10 Apr 2026 | Release 37, from the 2026-Q2 note. Adds Selectable Label Identifier in the Symbologies setting, so a symbology ID can be remapped before transmission to the host, and UDI label parsing for GS1 fields 715 and 716. |
| DS8178 | PAACXS00-013-R01 | CAACXS00-013-R01 | 10 Apr 2026 | Release 48, from the 2026-Q2 note. Same two changes as the DS8108. Cradle firmware is a separate component at CAACYS00-012-R01. |
| DS2208 | PAADES00-009-R00 | CAADES00-009-R00 | 11 Jun 2026 | Release 20, from the 2026-Q2 note. Resolves a rare condition where the previously scanned barcode was sent instead of the current one. |
| DS2278 | PAADFS00-008-R00 | – | 20 Nov 2025 | From the 2025-Q4 note, which lists a plug-in build for this model and no separate scanner component. Shared with the CR2278 cradle. |
| DS4608 | PAAEIS00-004-R00 | CAAEIS00-004-R00 | 23 Jul 2025 | Release 17, from the 2025-Q3 note. |
| LI4278 | PAABIS00-005-R02 | – | 7 Nov 2025 | From the 2025-Q4 note, which lists a plug-in build for this model and no separate scanner component. Shared with the STB4278 cradle. |
| DS9808 | Not verified | – | – | Not mentioned in any of the last eight Evolution Update notes, so no level is claimed here. A note only appears when firmware moves, which means either this model has not moved in two years or it is no longer covered. 123Scan would settle it. |
| ZD421 / ZD621 Link-OS | Not verified | – | – | Printer firmware, which the scanner Evolution notes do not cover. Link-OS 7.2 is the newest release note that exists in search indexes, but the document itself does not serve, so the per printer V9x build number is unknown. |
| Datalogic | ||||
| Magellan 9400i | Not verified | – | – | Re-checked on the open web on 13 Sep 2026 rather than assumed, after the same assumption about Zebra turned out to be wrong. Still not published: the fixed retail product pages carry no firmware, the download portal has no firmware category for this line, and its only firmware images are for Windows Mobile, CE and Android handhelds. |
| Magellan 9800i | Not verified | – | – | As above. Before any partner login is considered, the realistic route is DLRMUS, a free public download whose changelog refers to a bundled model list. A stored portal credential would be the most valuable thing on the collector host, and automating a partner login risks a suspended account rather than a failed script. |
| Opticon | ||||
| NLV-1001 | RBCV0155 | – | – | Published openly on the Opticon downloads page, one server rendered table per family, no login. Opticon prints no release date beside the code, so none is claimed here. The collector tracks all 37 current models; these are the lane relevant ones and the list is a starting point to trim. |
| NLV-4001 | TC27J05 | – | – | From the same open downloads table. |
| NLV-5201 | BD52J09 | – | – | From the same open downloads table. |
| MDI-4700 | BJ01J07 | – | – | From the same open downloads table. |
| MDI-5350 | BK01J01 | – | – | From the same open downloads table. |
| F-70 | TC03J10 | – | – | From the same open downloads table. |
| OPR-2001Z | TM07J09 | – | – | From the same open downloads table. |
| OPR-3201Z | TM07J09 | – | – | From the same open downloads table. |
| OPI-3601 | BA01J39 | – | – | From the same open downloads table. |
| Honeywell | ||||
| Genesis XP 7680g, Stratos, Solaris | Not verified | – | – | Checked on 13 Sep 2026. Honeywell publishes no scanner firmware or software version on the open web: the product pages carry none at all, and every download route ends at hsmftp.honeywell.com, which requires a sign in. This one needs an account before it can be collected. |
| OPOS and JavaPOS suites | Not verified | – | – | Same gate. Version numbers surface only inside support knowledge articles, which are prose rather than a catalogue, so nothing here is machine readable yet. No collector was written rather than one that could only ever emit empty rows. |
| HP | ||||
| Engage One Pro, BIOS S30 | 2.27.00 | – | 19 Aug 2026 | Security HP rates this release Critical. It addresses CVE-2026-20708, CVE-2026-20715 and CVE-2026-20734, and fixes the on-screen keyboard going missing after Secure Boot is switched on, which a touchscreen lane can depend on. Listed for Windows 10 IoT Enterprise 2021 LTSC. HP SoftPaq sp174265, effective 19 Aug 2026. Patch priority. |
| Engage One Pro G2, BIOS W30 | 2.07.00 | – | 19 Aug 2026 | Security The BIOS for the 15.6, 19.5 and 23.8 inch G2 systems, HP platform 8D09. HP rates this release Critical: the same three CVEs as the S30 release (CVE-2026-20708, CVE-2026-20715 and CVE-2026-20734) and the same on-screen keyboard fix after Secure Boot is switched on. Listed for Windows 10 IoT Enterprise 2021 LTSC. HP SoftPaq sp174264, effective 19 Aug 2026. Patch priority. |
| Engage One Pro G2, driver pack | 1.00 Rev A | – | 9 Dec 2024 | Windows 11 x64 pack covering the 15.6, 19.5 and 23.8 inch G2 systems, 22H2 through 24H2. |
| Engage Go, Engage One Essential | Not verified | – | – | The S30 SoftPaq explicitly excludes the Essential variant, and no Engage Go BIOS release note surfaced. The driver listings for these models are client side rendered, so they cannot be read without a browser. |
| Value Receipt Printer | Not verified | – | – | Dedicated support pages exist but return no driver rows. The C-Series receipt printer driver (A776, A798, A799, H300) is confirmed at 1.08 Rev B, 11 Feb 2020. |
Checked at source 14 Sep 2026
Peripheral advisories
Vendor security pages we read directly: Zebra, Datalogic, Epson and HP, plus the CISA ICS advisory releases. Zebra and Datalogic publish no register at all, so quiet from those two is not the same as clear. The numbered register is on the CVE tab.
Open, and structural
Networked Epson TM printers execute commands without authentication. No fix
ESC/POS over TCP 9100 has no authentication or encryption by design, so any host that can reach the printer can send it commands, reconfigure it, or read everything it prints. This was assigned CVE-2026-23767 at CVSS 9.8 in March 2026, and JPCERT records that the ESC/POS specification will not be revised, so no firmware fix is coming. The mitigation is network level only. Affects the whole TM line in the estate including TM-T88VI, TM-T88VII and the TM-m30 family. Treat receipt printers as untrusted endpoints on their own segment, not as quiet peripherals.
CVE-2025-66635, command execution in Epson WebConfig. Fixed firmware
An attacker holding the admin password can execute arbitrary commands from a specific WebConfig screen, reset settings, or ping other devices. 26 POS printer models affected. Fixed firmware exists for current generation products. Unique admin passwords, firewall, private addressing. The advisory does not enumerate per model fixed versions.
HP Engage One Pro can hang at a Secure Boot error after a Windows cumulative update. Lane hardware
HP support document ish_9642671-9641393-16 lists the HP Engage One Pro AIO System by name, alongside Engage Flex Pro, Flex Pro-C and Engage Go, among HP commercial products built 2017 to 2023 that use HP Sure Start. After a Microsoft cumulative update from July 2023 onward, a small subset of devices hang or loop continuously on a Secure Boot error screen. HP states the trigger is a system change made by the update but that the issue is not Microsoft's. Fix is a BIOS update; recovery on a stuck device means entering F10 setup and clearing Sure Start Secure Boot Keys Protection, which is hands on the hardware in a public space. Read this next to the Secure Boot certificate expiry item on the CVE tab: different root cause, same failure mode, and October brings both a Patch Tuesday and the 19 Oct certificate date. Read 14 Sep 2026.
Quiet
No open advisory touches the in counter scanners. Clear
The designated bulletin channel for this scanner line lists nothing referencing scanners, CoreScanner, OPOS or JPOS. Two CoreScanner CVEs exist, CVE-2015-1495 and CVE-2015-1496, both 2015 issues in the superseded Motorola Scanner SDK, still capable of surfacing in a vulnerability scan against a very old install. Note that recent printer advisories for this line reached the public through CISA ICS rather than the vendor bulletin page, so a quiet bulletin page is not the whole picture and the ICS feed is worth watching alongside it.
CVE-2017-6443, XSS in Epson WebConfig. Legacy
Still listed by Epson. Over 40 TM models including TM-T88IV, V and VI. Networked units only, firmware updates available.
Nothing new from any tracked vendor in the fortnight to 14 Sep 2026. Checked
Checked 14 Sep 2026. Zebra: the security alerts page carries nothing dated later than 2021 and has no separate index for the scanners, CoreScanner, 123Scan, the OPOS and JavaPOS drivers or the ZD421 and ZD621 printers. Datalogic publishes no advisory register at all: the security bulletin PDF was last revised in 2018 and the only live entry anywhere is CVE-2021-43333 on the DXU pages. Epson's notification index is unchanged, with the four most recent items all predating September. HP is the one that moved, and is recorded above. The CISA ICS advisory releases from 1 to 14 Sep 2026 name none of Zebra, Datalogic, Epson, Opticon, Newland or Honeywell. Note that Zebra's and Datalogic's silence is a property of their publishing, not evidence of health: neither runs a register that would show a gap.
Checked at source 15 Sep 2026 at 16:07
CVE register
5 exploitedWe filter for one question: does it reach a checkout lane. Everything here is checked against the CISA exploited catalogue, version 2026.09.11, and we say so when a CVE is not in it, because absence from that catalogue means no confirmed exploitation and that is worth knowing.
Exploited5
Confirmed exploited in the wild and reachable in this estate, counting the management plane. Two gained a KEV listing in the week to 11 Sep 2026, and two carry a CISA deadline inside ten days.
No fix today6
No patch exists. One will never be fixed, four wait on a vendor until April 2027, one is considered working as designed.
September load642
Of the 965 Microsoft CVEs published on 8 Sep 2026, this many list at least one Windows 10 LTSC build as affected.
Never researched0
CVEs have ever been published for OPOS, UnifiedPOS or JavaPOS control objects. That is an absence of attention, not an absence of bugs.
The register
| CVE | Lands on | What it gives | State | Fix |
|---|---|---|---|---|
| Act now: exploited, or no fix exists | ||||
| CVE-2026-84869 | ConnectWise ScreenConnect client, every version before 26.6.5 | Files can be transferred to and executed on the Host client system through an active remote session, without authorisation or Host confirmation. The server is not the affected component, the client is, so the exposure runs from a session back toward the machine running support, not only outward to the endpoint. | Exploited KEV 14 Sep 9.9 | ScreenConnect 26.6.5. Published 8 Sep 2026, added to the exploited catalogue 11 Sep with a three day due date. |
| CVE-2026-85880 | Windows ALPC, LTSC 2016, 2019 and 2021 | Heap overflow in the Advanced Local Procedure Call subsystem. Local escalation to SYSTEM, which is the second stage after any foothold on a till. | Exploited KEV 22 Sep 7.8 | September cumulative update |
| CVE-2026-23767 | Every networked Epson TM printer | ESC/POS over TCP 9100 requires no authentication. Anyone with a network path can print, reconfigure, brick the device, or read everything it prints. | No fix ever 9.8 | Segmentation and IP filtering only. JPCERT records that the specification will not be revised. |
| CVE-2025-35970 | Epson TM Web Config, confirmed on TM-T88VI, TM-m50II, TM-H6000V | The initial admin password is the device serial number, and the serial is readable over SNMP with no authentication. | Chain start 8.7 | No firmware fix. Change the password, disable SNMP where unused. Trivial to exploit and trivial to close. |
| CVE-2025-66635 | 35 Epson TM models | Command execution from a Web Config screen. Needs the admin password, which the row above hands over. Treat the pair as one attack path, not two findings. | Chained 8.6 | Fixed firmware available for current generation models |
| CVE-2026-19908<br>CVE-2026-19909<br>CVE-2026-19910<br>CVE-2026-19911 | PAX Q80 payment terminals, firmware 2.6.33.6690R | Unauthenticated root on an adjacent network, and an installer signature verification bypass that defeats the exact control meant to stop unauthorised code reaching a PIN entry device. | No fix 7.1 to 7.5 | None available. Disclosure ran ahead of a fix, and no fixed firmware is expected before April 2027. The only stated mitigation is to restrict interaction with the device. |
| CVE-2025-59287 | WSUS, where the server role is enabled | Unauthenticated remote code execution as SYSTEM through unsafe deserialisation. Does not affect Windows 10 clients, but a compromised WSUS is a direct path to every lane it serves. | Exploited KEV 9.8 | The out of band update of 23 Oct 2025. The 14 Oct patch was incomplete, so confirm which one the server took. |
| CVE-2026-47301 | Microsoft Configuration Manager site server | A four stage chain taking any authenticated domain user to SYSTEM on the site server. Public proof of concept exists. | Public PoC Partly unpatched | Partial fix 14 Jul 2026. The remaining links wait for ConfigMgr 2609 in October 2026. |
| Reaches a lane, and a fix exists | ||||
| CVE-2026-68839 | Windows USB Mass Storage Class Driver, all three builds | Remote code execution. The single most lane specific bug in the September release. | 9.8 | September cumulative update |
| CVE-2026-69768 | Windows RNDIS, all three builds | Remote code execution over USB attached networking, reachable by plugging in a device that presents as a USB network adapter. | 9.8 | September cumulative update |
| CVE-2026-69769 | Windows HTTP Print Provider, all three builds | Remote code execution. One of 11 print spooler and print provider issues this month, none of them exploited. | 9.8 | September cumulative update |
| CVE-2026-69525 | Remote Desktop Services, all three builds | Remote code execution. Matters only where a lane accepts inbound RDP for support access. | Test first 9.8 | September cumulative update, but Microsoft opened a known issue on 11 Sep 2026 for RDS becoming unstable after that same update, with LTSC 2016, 2019 and 21H2 on the affected list. Pilot before a fleet rollout. |
| CVE-2026-69731 | Windows HID Class Driver, all three builds | Local escalation. Relevant because a lane has keyboards, scanners and card readers presenting as HID devices. | 7.8 | September cumulative update |
| CVE-2026-69458 | BitLocker, all three builds | Elevation of privilege. A second BitLocker issue, CVE-2026-69449, allows remote code execution at 6.7. | 8.0 | September cumulative update |
| CVE-2022-36133 | Epson TM-C3500 and TM-C7500 colour label printers | Web Config authentication bypass with no credentials required. | 9.1 | Firmware update through the Epson business portal |
| CVE-2025-32008<br>CVE-2025-20080<br>CVE-2025-27708 | HP Engage One Pro, through Intel AMT and CSME firmware | Two network denial of service issues and one local read. Inert unless Intel AMT or Standard Manageability is provisioned, which on a typical store lane it is not. | 5.6 to 8.7 | HP bulletin HPSBHF04088, released 10 Feb 2026 and at Rev. 5 as of 3 Sep 2026. Minimum BIOS 02.25.00 (SoftPaq SP170192) for the HP Engage One Pro AIO System, but 02.05.00 (SP170191) for the Engage One Pro 15.6, 19.5 and 23.8 G2 AiO systems, so the fix level depends on which generation a lane carries. Read from HP 14 Sep 2026. |
| Management plane and POS software | ||||
| CVE-2026-86218 | N-able N-central before 2026.3.1.14 | Static code injection giving pre-authentication remote code execution on the management server. A change made there propagates to every system the platform manages, which is the whole point of the tool and the whole problem with the bug. | Exploited KEV 9.8 v3.1, 10.0 v4.0 | N-central 2026.3.1.14, shipped as 2026.3 Hotfix 4. KEV due date was 11 Sep 2026 and has passed. |
| CVE-2026-3564 | ConnectWise ScreenConnect before 26.1 | Per instance machine keys stored in server config could be extracted and reused to authenticate sessions. | Priority 1 9.0 | ScreenConnect 26.1 |
| CVE-2024-1708<br>CVE-2024-1709 | ConnectWise ScreenConnect before 23.9.8 | Path traversal and authentication bypass. Chained and used to deploy Medusa ransomware in April 2026, which is why the older of the two was added to the exploited catalogue two years after disclosure. | Exploited KEV 8.4 and 10.0 | ScreenConnect 23.9.8 |
| CVE-2026-60167<br>CVE-2026-60168<br>CVE-2026-60169<br>CVE-2026-60170 | Oracle Hospitality Simphony 19.8 to 19.10, component POS | Unauthenticated takeover of the application, access to the kiosk administrator console, NTLM hash coercion through the printing handler, and an arbitrary file write to the host. | 7.5 to 8.1 | July 2026 Critical Patch Update |
| CVE-2025-36537 | TeamViewer with Remote Management, before 15.67 | A local unprivileged user deletes arbitrary files as SYSTEM through MSI rollback. Only systems with Backup, Monitoring or Patch Management enabled. | 7.0 | 15.67, or 15.64.5 on the older branch |
| Historic, conditional, or superseded | ||||
| CVE-2014-7888 to<br>CVE-2014-7898 | HP OPOS drivers before 1.13.003 | Ten CVEs, remote code execution through the OPOS ActiveX controls. Covers displays, receipt and MICR printers, cash drawers, MSRs, keyboards and scanners. | Fixed 2015 | OPOS driver 1.13.003, SoftPaq SP70564. One inventory query settles this permanently. |
| CVE-2015-1495<br>CVE-2015-1496 | Motorola Scanner SDK, the CoreScanner ancestor | A remote buffer overflow and a local escalation through weak file permissions on CoreScanner.exe. | Superseded | The Zebra 3.x SDK line. Only relevant where legacy Motorola branded middleware survives. |
| CVE-2023-4957 | Zebra ZT410 and GK420d printers | Authentication bypass from the adjacent network when protected mode is off. | Discontinued hardware | Link-OS 6.0 protected mode. Both models went end of sale in 2020 and 2022 and support ended in 2025, so this reads as a lifecycle finding more than a vulnerability. |
| CVE-2017-6443 | Epson Web Config across 40 or so TM models | Cross site scripting. Needs an administrator to follow a crafted link. | Fixed firmware | Firmware versions 1.02 to 4.44 depending on model |
| CVE-2021-43333 | Datalogic DXU on rugged mobile computers | The DXU service requires no authentication to read or change configuration. In store relevant for DL-Axist and Skorpio handhelds, not for fixed lane scanners. | Config 6.5 | No fixed version published. Disable DXU. Off by default on current Skorpio X5. |
September 2026 Patch Tuesday, by type
Microsoft's largest release to date. Count the totals with care. Published figures run from 964 to 974 depending on whether Chromium and other third party CVEs are folded in: Tenable says 964, BleepingComputer 966, ZDI 972, SANS 973, Qualys and Rapid7 974. A direct count of the CVE Program records filed by Microsoft that day gives 965. The type breakdown above is the one most widely reproduced. Critical counts vary the same way, 104 to 114, and that is Microsoft's own severity rating, not CVSS: by CVSS base score only about 40 of the month's records reach 9.0.
The cluster that is specific to a till
22 USB and 2 HID vulnerabilities in one month. Estate specific
Led by CVE-2026-68839, USB Mass Storage Class Driver remote code execution at CVSS 9.8 on all three LTSC builds, and CVE-2026-69768, RNDIS remote code execution at 9.8, which is reachable by plugging in a device that presents itself as a USB network adapter. None are currently exploited.
This is the attack surface a checkout lane has and an office desktop does not: a physically reachable machine in a public space with live USB ports and a scanner, a scale, a card reader and a cash drawer hanging off them. Patching is the fix, but USB device installation policy, allowlisting by hardware ID, is the control that holds between patch cycles.
This is the attack surface a checkout lane has and an office desktop does not: a physically reachable machine in a public space with live USB ports and a scanner, a scale, a card reader and a cash drawer hanging off them. Patching is the fix, but USB device installation policy, allowlisting by hardware ID, is the control that holds between patch cycles.
Dated, and not a CVE
Secure Boot certificate expiry, 19 Oct 2026. 36 days
The Microsoft KEK CA 2011 expired on 24 Jun 2026 and the UEFI CA 2011 on 27 Jun 2026. Windows Production PCA 2011 expires 19 Oct 2026. Enterprise and IoT Enterprise LTSC 2019 and 2021 are all explicitly named as affected: the UEFI Secure Boot DB and KEK must be moved to the 2023 certificates or the device stops receiving new early boot protections. This is a firmware level change coordinated with the hardware vendor, not something a cumulative update does on its own, and fixed function retail hardware is exactly the category that gets missed. LTSC 2016 is not listed on Microsoft's page and its status could not be confirmed either way.
Deployment tooling holds credentials in lane memory. By design
VU#164934. PDQ Deploy's Deploy User run mode places credentials in the active memory of the target device during a deployment, where they can be extracted and reused to move laterally across domain joined systems. No CVE was assigned and no patch is planned, the behaviour being treated as inherent to Windows authentication rather than a product defect. The recommended controls are Windows LAPS, least privilege, avoiding domain admin credentials, and the Logged on User run mode.
Worth sitting with: lanes are the least physically secure domain joined machines in the estate, standing in a public space, and the deployment tool routinely hands them credentials that work fleet wide.
Worth sitting with: lanes are the least physically secure domain joined machines in the estate, standing in a public space, and the deployment tool routinely hands them credentials that work fleet wide.
Where this register is blind
Four categories where an empty result means nobody looked.
OPOS, UnifiedPOS and JavaPOS control objects have never had a CVE. They are unsigned COM objects registered machine wide and loaded in process by the POS application on every lane, which is a textbook hijack surface. No advisory stream exists to subscribe to.
Payment terminal firmware largely sits outside the CVE system. It is patched through PCI PTS certified channels instead, so the public record structurally understates the category. A sweep across the major terminal lines for 2024 to 2026 returns almost nothing, and that is a property of the disclosure route rather than a clean bill of health.
A maintained advisory feed does not exist for every line on this board. For most of the peripheral lines here there is no security feed to subscribe to, and one publishes BIOS CVEs inside per package release notes rather than on a product security page. Where that is the case NVD and CISA ICS have to be watched directly, and a bulletin page with nothing recent on it cannot be read as an absence of issues.
Retail POS software is thinly covered. A sweep across the major retail POS suites returns no 2025 or 2026 CVEs at all, and several carry a single record going back a decade. Given how much of this software runs on a lane, that is far likelier to describe how little of it is researched than how few bugs it holds.
Payment terminal firmware largely sits outside the CVE system. It is patched through PCI PTS certified channels instead, so the public record structurally understates the category. A sweep across the major terminal lines for 2024 to 2026 returns almost nothing, and that is a property of the disclosure route rather than a clean bill of health.
A maintained advisory feed does not exist for every line on this board. For most of the peripheral lines here there is no security feed to subscribe to, and one publishes BIOS CVEs inside per package release notes rather than on a product security page. Where that is the case NVD and CISA ICS have to be watched directly, and a bulletin page with nothing recent on it cannot be read as an absence of issues.
Retail POS software is thinly covered. A sweep across the major retail POS suites returns no 2025 or 2026 CVEs at all, and several carry a single record going back a decade. Given how much of this software runs on a lane, that is far likelier to describe how little of it is researched than how few bugs it holds.
Checked and not applicable here
| CVE | Why it does not apply |
|---|---|
| CVE-2026-81963 | The other September zero day, in the Windows Update stack, and also exploited. It lists only Windows 11 and Server 2025 as affected. It does not reach a Windows 10 LTSC lane. |
| CVE-2026-42016<br>CVE-2026-42018<br>CVE-2026-67277<br>CVE-2026-86060<br>CVE-2026-19490<br>CVE-2026-20079<br>CVE-2026-85706<br>CVE-2026-75650 | The rest of the exploited catalogue additions in the week to 11 Sep 2026: JFrog Artifactory, MikroTik RouterOS, Citrix NetScaler, Cisco Firewall Management Center, GitLab and Adobe Commerce. All are real and several are network edge or build chain issues worth someone's attention, but none is a lane, a peripheral, a payment terminal or the tooling that deploys to them. Listed here so the same week is not re-triaged next run. |
| CVE-2026-73542 | Epson retained revoked root certificates. The affected list runs to 266 models, all inkjet, laser, scanner and large format. No TM series, no UB interface boards. |
| CVE-2025-64310 | Epson, no rate limiting on authentication. Projector products only. |
| CVE-2025-42598 | Epson Windows driver local escalation in non English environments. Epson's affected list names the Universal Printer Driver and consumer lines; no POS driver is listed, though absence from a list is not the same as confirmed unaffected. |
| CVE-2019-13526 | Datalogic AV7000. An industrial conveyor and parcel scanner, not a lane scanner. |
| CVE-2026-58315<br>CVE-2024-47295<br>CVE-2023-23572 | Epson Web Config issues whose affected model tables cover consumer and office print lines only. No POS models listed. |
Checked at source 14 Sep 2026
GS1 Sunrise 2027
Scanner and hostAmbition 2027 globally, Sunrise 2027 in the US, QR Code powered by GS1 in the Netherlands. We read these from gs1.org, gs1us.org and gs1.nl: the end of 2027 date has not moved, and all five documents below are still at the versions shown.
472days to 31 Dec 2027
What it actually says, and where it does not agree with itself
All retail POS systems should be able to read and process a defined set of 2D barcodes by the end of 2027, alongside existing linear barcodes. Read that sentence carefully: the burden sits on the read side, not the print side. The lanes carry it. Suppliers carry nothing, and for brand owners the transition is explicitly optional, so supplier pressure will not set the pace.
GS1 global calls it a goal; GS1 US calls it a milestone and adds that "it is not necessary to implement all the capabilities of 2D by that date". Checked on gs1.nl 14 Sep 2026: GS1 Nederland does not use the word verplichting. Its published wording is a commitment, "Retailers committeren zich aan helder doel: eind 2027 zijn hun systemen gereed om de QR Code powered by GS1 te scannen", and Albert Heijn, Jumbo, Kruidvat, HEMA and others are listed as having committed. An earlier version of this board quoted an obligation wording that does not appear on GS1 Nederland's site. The distinction matters commercially: a Dutch retailer can point at a public commitment it has made, which is a different conversation from a rule it is obliged to meet.
What the scanner has to do
- Decode all three retail 2D types: GS1 DataMatrix, QR Code carrying a GS1 Digital Link URI, and Data Matrix carrying a Digital Link URI.
- Handle normal and reversed reflectance.
- Decode in under 300 ms on a bioptic, under 500 ms on presentation and activated handheld.
- Support scanning modes 1, 2 and 3.
- Let the retailer configure which data is transmitted.
EAN and UPC are not being switched off. Dual marked packs are expected right through the transition, which is why the co-located barcode cases matter more than the plain 2D read.
What the POS host has to do
- Parse both GS1 element string syntax and GS1 Digital Link URI syntax.
- Accept a 14 digit GTIN (09506000134352, not only 9506000134352) and store it normalised.
- Identify the right item when linear and 2D sit on the same pack, with one beep, not two.
- Process optional AIs: expiry 17, batch or lot 10, serial 21, weight.
- Act on them: expiry stop sale, batch recall blocking, date driven markdown.
- Persist everything received for backend use.
This is the half that is genuinely engineering work. The likely failure is not a no read: the scanner decodes fine and hands the host a Digital Link URI or a 14 digit GTIN, and the host returns item not found.
Fleet position
| Question | Answer | Detail |
|---|---|---|
| Imager or laser | Hard line | 2D at POS needs an image based scanner. No firmware rescues a laser, there is no image to process. Any remaining laser lane is a replacement, not an upgrade. Audit this first, it is the only part with a capex tail. |
| Zebra MP7000 | Capable | Multiple CMOS array imager. Decodes Aztec, DataMatrix, MicroPDF417, MicroQR, PDF417, QR and Han Xin, with integrated Digimarc support. Digital Link arrived by firmware, not hardware: reseller documentation puts MP7000 in an April 2025 wave across 16 Zebra models, configured through 123Scan with the mode set in the Symbologies tab, mode 2 recommended. That firmware claim comes from reseller documentation and was not confirmed against the vendor's own release notes. Remember the MP7000 is end of sale since 15 Sep 2025. |
| Datalogic Magellan 9400i | Capable | Digital imagers in all planes, reads 1D, 2D and Digimarc. The product sits under a vendor path named /retail-gs1-digital-link/, but the page does not state Digital Link parsing specifics or an upgrade path, so treat the positioning as a signal rather than a conformance statement. |
| Datalogic Magellan 9800i | Not verified | Same product family and same Digital Link URL path, but the symbology list and Digital Link statement were not retrieved. Capability by family inference is not asserted here. |
| Is imager enough | No | GS1's own guideline warns that "not all imaging scanners will be capable of the Ambition 2027 goal". The bar is the full criteria above, including reversed reflectance and the latency budget. A scanner that decodes a QR code on the bench can still miss 300 ms at lane speed. Per model conformance is worth getting from Zebra and Datalogic in writing. |
The one thing worth doing this quarter
Run the GS1 capability test suite on a real lane. Free
Release 1.1, February 2025. 35 tests, around 30 minutes once set up, results recorded in a supplied spreadsheet. It is the only objective readiness gate that exists, and it tests scanner and host together rather than separately. Tests 1 to 10 cover GTIN only baselines, 11 and 12 check that non GS1 barcodes are correctly ignored, 13 to 27 walk the AIs across all three 2D types, and 28 to 35 cover co-located barcodes on dual marked packs. The last two groups are where real fleets fail and are not things anyone would think to test unprompted.
Normative documents, and their current versions
| Document | Version | Date |
|---|---|---|
| POS Host and Backend Systems Playbook | 1.0.1 | May 2026 |
| Creation and Printing Playbook | 1.0.1 | Jun 2026 |
| 2D at Retail POS Implementation Guideline | 1.1.0 | Dec 2025 |
| Solution provider 2D readiness criteria | 1.0.0 | Apr 2025 |
| 2D Barcodes in Retail test suite | 1.1 | Feb 2025 |
The host playbook from May 2026 is the one document on this list written for POS software implementers. Separately, and corrected on 14 Sep 2026: GS1's published list of 2D ready solution providers is not empty. Read live from gs1.org it names 32 companies across four categories, including six under POS Scanner: Newland AIDC, Honeywell, Datalogic, Zebra, Keyence and TSC. Four of those six are already vendors in this estate. The list is built from a script driven dropdown, so a plain page fetch returns nothing and reads as an empty list, which is how this board came to state the opposite. Entries are vendor self attestation, published by GS1 with no warranty of accuracy, so treat a listing as a claim to put to the vendor rather than a conformance statement.
There is no public scoreboard for POS readiness. Read numbers carefully
No GS1 readiness survey for 2025 or 2026 could be found, and no named retailer is publicly live with 2D at POS. The widely quoted "84 percent of retailers planning" and "68.5 percent still on laser" figures are from a March 2020 GS1 US study and are six years old. The only current figure found is fewer than 20 percent of Amazon brand partners actively planning, and that came from one person's informal poll reported in February 2026. If a vendor quotes a 2026 global adoption percentage, ask for the source. The end of 2027 date itself has not slipped, re-checked 14 Sep 2026, but GS1 publishes no dated interim milestones against it. The one non dated threshold it does publish is in the December 2025 implementation guideline: dual marking continues until 90 percent of POS scanning solutions are 2D capable.
Checked at source 14 Sep 2026
Fiscalisation
61 marketsEurope in detail, the rest of the world by exception. We re-check every European deadline ourselves and every correction carries its source in the row, because this is the tab where being a year out costs the most.
How much of this reaches the till
Certified till20
A certified device, fiscal memory, secure element or certified till software is required at the point of sale.
Real time20
Every sale is transmitted or cleared with the authority, but the till itself is not certified.
Invoice only11
Mandatory e-invoicing exists, but it does not reach an ordinary consumer sale.
None10
Nothing at the till. Receipts are a commercial document, not a tax document.
Four levels, ordered by how deep the rule goes into the point of sale. The distinction that matters is between a regime that regulates invoices and one that regulates the till. Plenty of countries have mandatory e-invoicing that an ordinary consumer sale never touches, and a handful of large economies regulate nothing at the till at all. Counts are derived from the tables below.
Benelux and the neighbours
NetherlandsNone
geen fiscalisering
No fiscal memory, no signing device, no reporting, no receipt QR, no mandatory certification. Obligations are the general bookkeeping ones under art. 52 AWR: complete and correct records, detail data retained not just Z totals, seven years. The Belastingdienst handreiking is guidance aimed at developers, not law. The Keurmerk Betrouwbare Afrekensystemen is voluntary and market run, a commercial differentiator rather than a compliance gate. One of the few European markets that regulates nothing at the point of sale.
Next: nothing scheduled
BelgiumCertified till
GKS 2.0 / SCE
Certified POS software plus a Fiscal Data Module. GKS 2.0 drops the VAT Signing Card and has the FDM transmit straight to FPS Finance, which is an architectural change rather than a firmware bump. Tolerance was extended twice and ended 30 Jun 2026; new hospitality entrants have gone straight to 2.0 since 1 Jul 2026. Migration waves key off the purchase date of the register, so install bases need auditing now, and there are three of them, not two: 1 Jul 2027 for registers bought up to 31 Dec 2017, 1 Jul 2028 for 2018 to 2021, and 1 Jan 2029 for registers bought from 1 Jan 2022. What is signalled but not enacted is extension to the whole hospitality sector, removing the threshold that exempts smaller operators, plus the carwash trade; the royal decree is sitting with budget discussions. Wave detail and scope per ITAA and Belgian practice guidance, read 14 Sep 2026.
Next: 1 Jul 2027, registers bought up to 31 Dec 2017
GermanyCertified till
KassenSichV / TSE
Certified TSE signing every transaction, DSFinV-K export on demand, receipt issued for every sale, ten year retention, unannounced Kassen-Nachschau. The reporting duty via Mein ELSTER has run since 1 Jan 2025 and the catch up deadline passed in July 2025, so missing or wrong registrations are now audit exposure. New systems must be reported within one month of commissioning. From Jan 2026 restaurant food is back to 7 percent while drinks stay 19, which needs clean rate separation in mixed sales.
Next: rolling, one month per new system
FranceCertified till
NF525 + e-invoicing
The certification cliff was cancelled. Finance Law 2025 had removed editor self attestation, pushing everyone toward accredited NF525 or LNE certificates by 31 Aug 2026. Finance Law 2026 article 125, adopted 19 Feb 2026, reinstated the individual attestation. Either route is now valid and no third party audit is compulsory. Separately the e-invoicing mandate went live on 1 Sep 2026: everyone must be able to receive, large enterprises and ETIs must issue. For retail the POS facing piece is B2C e-reporting, not e-invoicing.
Next: 1 Sep 2027, SMEs must issue and e-report
Rest of Europe
| Market | Reaches | Regime | What the till has to do | Next |
|---|---|---|---|---|
| Italy | Certified till | RT | Certified registratore telematico transmitting daily takings. Since 1 Jan 2026 payment terminals must be logically linked to the RT, registered through Fatture e Corrispettivi. Penalties 1,000 to 4,000 euro for a missing link. The instant receipt lottery still has not launched; the weekly one runs normally. | rolling |
| Spain | Certified till | VeriFactu | Chained, hash linked, signed invoice records with a QR on every invoice, either streamed to AEAT or stored tamper evidently, from software carrying a producer declaration. Delayed a second time by Real Decreto-ley 15/2025 of 2 Dec 2025, a royal decree-law rather than a royal decree, which is what to search for in the BOE. TicketBAI is separate and is mandatory across the three Basque provinces. Navarra does not use TicketBAI: it has its own regime, branded NaTicket, whose technical specification is not final and which is not yet in force. Read 14 Sep 2026. | 1 Jan 2027 |
| Portugal | Certified till | ATCUD | AT certified software, ATCUD code and QR on every invoice, monthly SAF-T PT. From Jan 2027 a PDF invoice needs a qualified electronic signature to count as an e-invoice. | 1 Jan 2027 |
| Poland | Certified till | Kasy online + KSeF | Certified online cash registers streaming to the central repository, required by designated sectors rather than universally, plus structured e-invoicing through KSeF: large enterprises above PLN 200m turnover from 1 Feb 2026, other VAT payers from 1 Apr 2026. The duty to receive through KSeF applied to everyone from 1 Feb 2026. Micro entrepreneurs invoicing under PLN 10,000 gross a month were carved out and join on 1 Jan 2027, which is also when the transition reliefs end and sanctions begin. Ministerstwo Finansów, read 14 Sep 2026. | 1 Jan 2027 |
| Greece | Certified till | myDATA | Certified registers linked to AADE, QR on receipts, payment terminals interconnected with the register per A.1098/2022 and A.1155/2023. B2B e-invoicing is in its final phase. | 30 Sep 2026 |
| Austria | Certified till | RKSV | Signature creation device, AES-256 chained signatures, QR on the receipt, DEP export. Mandatory above 15,000 euro turnover with more than 7,500 in cash. No change pending. | none |
| Romania | Certified till | AMEF + RO e-Factura | Fiscal cash registers alongside B2B and B2C e-invoicing. From 1 Jan 2026 e-Factura scope extends to non resident VAT registered customers and the submission window relaxes from 5 calendar to 5 working days. The AMEF cash register regime is long established but was not re-verified for this board. | in force |
| Norway | Certified till | Kassasystemlova | The Nordic exception. The supplier files a product declaration with Skatteetaten and only declared systems may be used. Electronic journal, X and Z reports, no delete function, SAF-T Cash Register export with a digital signature. Skatteetaten publishes the list of declared systems. | none |
| Serbia | Certified till | E-fiskalizacija | ESIR sends each sale to a local or virtual PFR, which signs it with a cryptographic security element and transmits in real time, with an offline buffer. QR on the receipt, and both ESIR and PFR must be on the accredited list. From 1 Apr 2026 retail sales to corporate cardholders need an e-invoice issued after the fiscal receipt. | 1 Jan 2027 |
| Albania | Certified till | Fiskalizimi | No turnover threshold, it applies from the first sale. Certified software hashes each invoice (NSLF), signs with the taxpayer certificate, and the administration returns an NIVF; both print on the receipt. Cash points need registered devices, offline ceiling is 48 hours, a failed device must be replaced within 5 days. A generic ERP connector or Peppol access point is explicitly not sufficient. | in force |
| Ukraine | Certified till | RRO / PRRO | Hardware RRO or state certified software PRRO registered with the tax service, with cloud PRROs transmitting continuously. QR on the receipt for verification. Covers cash, card and payment service provider settlements; direct IBAN transfers are exempt. Fines are 100 percent of transaction value, then 150. | in force |
| Russia | Certified till | 54-FZ online kassa | The most invasive model on this page. Every till needs a replaceable cryptographic fiscal drive registered with the FNS plus a contract with an accredited OFD that relays every receipt. QR on the receipt, versioned FFD payload, 30,000 rouble fine per payment without one. VAT rose to 22 percent on 1 Jan 2026 and the inspection grace period has lapsed. | in force |
| Bosnia | Certified till | Fiscalisation Law | Entity level hardware fiscal registers today. A new state law enacted 12 Feb 2026 introduces an approved electronic fiscal system with certified devices and real time transmission, phased. | 2028 |
| Hungary | Real time | e-nyugta | Since 1 Sep 2026 around 270,000 taxpayers report aggregated daily receipt data to NAV within three calendar days, split by VAT rate, via cloud register, the KOBAK portal or M2M. Grace period to 31 Dec 2026, fines after. Hardware e-cash registers become mandatory 1 Jul 2028. | 1 Jan 2027 |
| Croatia | Real time | Fiskalizacija 2.0 | Mandatory B2B and B2G e-invoicing plus e-reporting between VAT registered taxpayers since 1 Jan 2026, with monthly e-reporting by the 20th. B2C is not in the e-invoicing mandate: consumer sales stay under receipt fiscalisation, and what changed on 1 Jan 2026 there is that fiscalisation now covers all payment methods rather than cash alone. Porezna uprava treats the two as separate procedures. From 1 Jan 2027 the duty to issue extends to taxpayers not registered for VAT, who until then need only be able to receive. Read 14 Sep 2026. | 1 Jan 2027 |
| Czechia | Real time | EET 2.0 | EET was abolished with effect from 1 Jan 2023, so nothing reaches the till today. Reintroduction as EET 2.0 was approved by the Chamber of Deputies on 15 Jul 2026, returned with amendments by the Senate on 19 Aug 2026, and finally adopted when the Chamber overrode the Senate on 9 Sep 2026. Covers payments involving in person contact: cash, card, QR and mobile. Paper receipts are not mandatory. Self employed people in the first flat tax bracket up to CZK 1m turnover can opt out entirely in exchange for a higher monthly prepayment. Ministerstvo financí and Finanční správa, read 14 Sep 2026. | Jan 2027 |
| United Kingdom | None | none | Nothing at the till. Making Tax Digital is digital record keeping and API filing by the business, not fiscalisation: no receipt format, no device certification, no transaction reporting. The announced B2B mandate is four corner Peppol with no real time feed to HMRC. | 1 Apr 2029 |
| Switzerland | None | none | Nothing at the till, explicitly unlike Germany. The obligation sits on the cash book: daily, chronological, unalterable entries, full books above CHF 500,000 turnover, ten year retention. | none |
Beyond Europe
| Market | Reaches | Regime | What the till has to do | Next |
|---|---|---|---|---|
| Americas | ||||
| Brazil | Real time | NFC-e | Sign the XML with an ICP-Brasil certificate, get per sale authorisation from the state SEFAZ, print the DANFE with a QR derived from the state issued CSC, with offline contingency. Since 3 Aug 2026 every NFC-e must carry populated IBS and CBS fields or it is auto rejected. Sao Paulo retired SAT-CF-e on 31 Dec 2025 and moved retail to NFC-e. | 1 Dec 2026 |
| Mexico | Real time | CFDI 4.0 | Build the CFDI XML, sign with the CSD, have it stamped by an authorised PAC. Walk in customers get a simple ticket, consolidated into a factura global against the generic RFC. | none |
| Chile | Real time | Boleta Electronica | Signed XML DTE drawing folios from an authorised CAF range, reported to SII with a daily consumo de folios. Since 1 May 2025 in person B2C sales must hand over a printed representation. | none |
| Colombia | Real time | Documento equivalente POS | Signed XML pre-validated by DIAN before the receipt reaches the customer, which puts authority latency on the critical path. Paper contingency must be transmitted within 48 hours. Paper POS tickets are no longer valid. | in force |
| Argentina | Certified till | Controlador Fiscal | High volume retail and food service selling to final consumers must issue through an ARCA homologated fiscal controller storing fiscal data and filing periodic reports. Other taxpayers may use electronic invoicing instead. The current exemption boundary was not verified against a primary source. | in force |
| Peru | Real time | SEE boleta | Signed UBL boleta with QR at the till, transmitted to SUNAT in a resumen diario, same day or up to the seventh calendar day. | none |
| Uruguay | Real time | CFE e-Ticket | Obtain a CAE numbering range from DGI, issue the signed XML e-Ticket, transmit and retain five years. Universal for all VAT taxpayers since 1 Jan 2026. | complete |
| Costa Rica | Real time | Tiquete v4.4 | XML v4.4 with a 50 digit clave signed with the taxpayer key, pushed to the TRIBU-CR API. No fiscal validity until accepted, and no batch option. | none |
| Dominican Rep. | Real time | e-CF | DGII authorised invoicing system issuing signed XML e-CF; consumer sales use type 32. DGII validates and returns a tracking number. | 15 Nov 2026 |
| United States | None | none | No fiscalisation at all. No certified device, no fiscal memory, no clearance, no mandated receipt format. The receipt is a commercial document. The engineering effort is entirely rate and sourcing accuracy across roughly 13,000 jurisdictions, product taxability, exemption certificates, marketplace facilitator rules and economic nexus. A genuinely different model, not a gap. | none |
| Canada | None | none, except Quebec | Nothing federally. Quebec is the exception: restaurants, bars, caterers and paid passenger transport need a certified SEV transmitting to MEV-WEB and printing a QR plus transaction number. Quebec retail generally is not covered. | in force |
| Middle East | ||||
| Saudi Arabia | Real time | ZATCA Fatoora | Phase 2. B2C simplified invoices are cryptographically stamped locally, carry a TLV QR code on the receipt and are reported to ZATCA within 24 hours; B2B standard invoices are cleared before issue. UUIDs, hash chaining and anti tamper controls throughout. Wave 25 halved the threshold to SAR 187,500. | 1 Feb 2027 |
| Turkey | Certified till | YN OKC + e-Arsiv | Sales run on a GIB approved new generation cash register with secure fiscal memory, TSM connectivity and Z reports matched to GIB. From 2026 businesses in scope may not use standalone or mobile card terminals, payment must go through an EFT-POS enabled register. Above the threshold an e-Arsiv invoice replaces the receipt. | 1 Oct 2026 |
| United Arab Emirates | Invoice only | PINT AE | Peppol five corner exchange through an accredited service provider with a reporting leg to the FTA. Scope is B2B and B2G, so the retail till is not affected for ordinary consumer sales. | 1 Jan 2027 |
| Israel | Invoice only | Allocation number | Above the threshold, a tax invoice to a business customer claiming input VAT needs an allocation number from the tax authority API printed on it. Does not apply to private consumers, so an ordinary retail till is untouched. Threshold has fallen to NIS 5,000. | undated |
| Jordan | Real time | JoFotara | Every invoice including B2C is submitted for validation and the authority returns a QR that must appear on the document, so this one does reach the till. Four year tamper proof retention. | undated |
| Oman | Invoice only | Fawtara | PINT OM through an accredited service provider. Pilot only, and the timeline was pushed back in Aug 2026. Nothing at the till today. | 1 Apr 2027 |
| Qatar | Invoice only | GTA e-invoicing | Law and regulations approved 6 May 2026, pilot running. B2B is clearance, and B2C is planned as a live reporting model, so it will reach the till eventually. Specs still pending. | 1 Jan 2027 |
| Africa | ||||
| Egypt | Real time | ETA e-receipt | Each POS device is registered with the authority, holds a class 2 digital certificate and submits every receipt in real time over TLS; the authority returns a UUID and the receipt carries a QR. Still rolling out B2C by tax office rather than universally. | 31 Mar 2026 |
| Kenya | Real time | eTIMS | Every invoice including B2C is transmitted before issue and the authority returns a control unit invoice number, signature and QR that print on the receipt. Integration is via software control units, not certified hardware, so the burden is integration rather than certification. | in force |
| Ghana | Real time | E-VAT | Invoices and sales receipts go through a GRA certified invoicing system to the virtual sales data controller, which returns a clearance number, signature, QR and timestamp to embed on the document. Final rollout tranche not verified. | undated |
| Tanzania | Certified till | EFD / VFD | Fiscal receipt from an approved device for every sale: sequential numbering, SHA1 with RSA signature, receipt verification code and QR, daily Z report, real time submission with offline queueing. A proposed move to token based pre-clearance would turn an offline tolerant design into a blocking online dependency. | undated |
| Nigeria | Real time | EFS / MBS | Clearance style: transmit to the revenue service platform and receive an invoice reference number. Large taxpayers only; no published date for a retail or B2C phase. | not verified |
| Angola | Certified till | Facturacao electronica | Invoicing software must be certified or validated by the AGT, plus SAF-T (AO) and inventory file submission. In force since 1 Jan 2026 for large taxpayers and anyone invoicing above AOA 25m. Retail treatment is not explicit in the sources. | undated |
| Morocco | Invoice only | DGI e-invoicing | Clearance of XML on the DGI platform with ICE validation and a ten year archive. B2B and B2G only in this phase, B2C is explicitly deferred, so the till is out of scope for now. | 2027 |
| South Africa | None | consultation | Nothing required today. SARS published a VAT modernisation consultation paper in Aug 2026 proposing structured e-invoicing and near real time reporting, with phased adoption floated for around 2030. Nothing is mandatory and there is no binding commencement date. | 16 Oct 2026 |
| Asia Pacific | ||||
| Taiwan | Real time | eGUI | Heavy till involvement. Invoice numbers are allocated by the ministry, so the POS cannot generate its own and must manage number block inventory. Issue the eGUI, print a QR receipt or write to a carrier, upload MIG 4.0 XML. B2C credit notes upload within two days. | complete |
| South Korea | Real time | Cash Receipt | A genuine till obligation: capture a buyer identifier and get an approval number from the tax service. Designated sectors must issue automatically at KRW 100,000 and above whether or not the customer asks. Penalty is 20 percent for a mandatory sector failure. | none |
| Vietnam | Real time | Decree 70/2025 | The clearest recent case of an invoice regime pushed down into the cash register. Covered retail and hospitality sellers generate the e-invoice from the till per sale, transmit the same day and give the buyer a QR lookup. Deliberately exempt from the digital signature requirement. | in force |
| India | Invoice only | GST e-invoicing | B2B only: push JSON to an invoice registration portal and print the returned IRN and signed QR. Retail B2C sales need no IRN. Separate rule: above AATO 500 crore a dynamic QR carrying payment details goes on B2C invoices. B2C e-invoicing remains a voluntary pilot. | not dated |
| China | Invoice only | Fully digitalised e-fapiao | No Golden Tax hardware at the till any more. Fapiao are issued from the tax platform in XML and validated centrally, on customer request rather than automatically per sale. Ordinary retail receipts are not fiscalised. The new VAT Law made e-fapiao the sole legal invoice format on 1 Jan 2026. | end 2026 |
| Malaysia | Invoice only | MyInvois | Cleared e-invoices return a unique number and validation QR. Consumers who do not ask get a normal receipt covered by a consolidated periodic e-invoice, but from 1 Jan 2026 consolidation is prohibited above RM10,000, which is the rule that bites at a till. | in force |
| Philippines | Invoice only | EIS + ESRS | Covered taxpayers must issue system generated structured invoice data that a printout does not satisfy. POS and cash register users are explicitly in a later phase, contingent on the authority standing the system up. | 31 Dec 2026 |
| Indonesia | Invoice only | Coretax e-Faktur | Clearance covers B2B and B2G. A retail taxable business issues a simplified tax invoice, which may be an ordinary till slip, and may aggregate end consumer sales. No B2C or POS mandate. | none |
| Singapore | Invoice only | GST InvoiceNow | Structured invoice data to the tax authority through a Peppol access point. B2B and B2G, not a till obligation. | 1 Apr 2028 |
| Japan | None | Qualified Invoice | No device, no reporting. The receipt must carry the issuer registration number and tax split by 8 and 10 percent. Retail, restaurants and taxis may use the simplified qualified invoice, which is the format POS actually implements. Transitional input credit relief steps from 80 to 50 percent on 1 Oct 2026. | 1 Oct 2026 |
| Thailand | None | voluntary | Nothing mandatory at the till. Signed XML e-Tax Invoice and e-Receipt are optional, submitted by the 15th of the following month. No legislated mandate for 2026 or 2027. | none |
| Australia | None | none | Nothing at the till. No certified register, no fiscal memory, no reporting. Peppol is government supplier side only and the business eInvoicing right was never enacted as a B2B mandate. | none |
| New Zealand | None | none | Nothing at the till. Peppol obligations sit on government agencies and their large suppliers. | 1 Jan 2027 |
The heaviest lifts, in rough order. Brazil, for per sale authorisation against 27 separate state authorities plus a live constitutional tax reform whose IBS and CBS fields have been hard rejected since 3 Aug 2026. Russia, for a registered cryptographic fiscal drive inside every till and a commercial intermediary relaying every receipt. Turkey, the only market combining certified fiscal hardware with a parallel e-invoice stack, and since 2026 forbidding standalone and mobile card terminals for businesses in scope. Serbia and Albania, for real signing components with offline buffers, where Albania has no turnover threshold at all and states plainly that a generic ERP connector or Peppol access point is not sufficient. Taiwan is the underrated one: invoice numbers are allocated by the ministry, so the till cannot mint its own identifiers and has to manage number block inventory.
Estate calendar, next 24 months
Sep 2026
30FiscalGreece, deadline to declare to AADE whether a certified provider or the state apps will be used.
Oct 2026
01FiscalGreece, remaining businesses adopt mandatory B2B e-invoicing, transition to year end. Brazil, NFS-e and NFCom join the IBS and CBS calendar. Turkey, pharmacies and opticians extension.
12FiscalGreece, final phase: effectively all resident businesses issue B2B invoices in real time via myDATA.
13LifecycleWindows 10 IoT Enterprise LTSC 2016 leaves support. Also October Patch Tuesday.
16FiscalSouth Africa, comments close on the SARS VAT modernisation consultation.
Nov 2026
15FiscalDominican Republic, small, micro and unclassified businesses join e-CF.
Dec 2026
01FiscalBrazil, NF-e for non-ICMS taxpayers enters the IBS and CBS regime.
31FiscalHungary, grace period on receipt data reporting ends. Portugal, last day a plain PDF counts as an e-invoice. Philippines, large taxpayers, e-commerce and invoicing software users must be issuing structured data.
Jan 2027
01FiscalSpain, VeriFactu wave 1. Portugal, PDF invoices need a qualified electronic signature. Hungary, standard fines begin. Croatia, issuing duty widens. Czechia, EET 2.0 starts. Brazil, Simples Nacional joins. UAE, go live above AED 50m. Qatar, expected go live.
12LifecycleWindows 10 Enterprise LTSC 2021 leaves support. The IoT edition of the same build is unaffected until 2032.
Feb 2027
01FiscalSaudi Arabia, ZATCA wave 25 integration, threshold down to SAR 187,500.
Apr 2027
01FiscalOman, Fawtara phase 1 for supplies above OMR 5m, moved back from February.
Jul 2027
01FiscalSpain, VeriFactu wave 2. Belgium, GKS 2.0 migration wave 1: registers purchased up to 31 Dec 2017. UAE, SMEs.
Sep 2027
01FiscalFrance, SMEs and micro enterprises must issue e-invoices and meet e-reporting.
Dec 2027
31GS1GS1 Sunrise 2027, retail POS should read and process 2D barcodes. GS1 Nederland words this as an obligation on retailers.
Jul 2028
01FiscalBelgium, GKS 2.0 wave 2. Hungary, hardware e-cash registers become mandatory.
ViDA sets the far horizon in Europe. The VAT in the Digital Age package entered into force on 14 Apr 2025 and already matters, because it lets member states mandate domestic e-invoicing without a Council derogation, which is why France, Poland, Croatia and Belgium all moved at once. The dates that bite later: digital reporting for intra-EU B2B on 1 Jul 2030, and 1 Jan 2035 as the convergence deadline by which existing national systems must align with the EU standard. ViDA targets cross border B2B, so domestic B2C till receipts stay a national competence. Nothing equivalent exists globally: outside the EU every regime on this page is its own sovereign design, which is why the till work does not generalise.
Checked at source 13 Sep 2026
Field notes
23 notesThings that turned up while we were assembling the rest of this board. We keep them here rather than dropping them, because the awkward details are usually the ones that cost someone a day.
Things that are not what they look like
Windows
The same build, five years apart
Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021 are both build 19044 and take the same monthly KB. The desktop SKU ends 12 Jan 2027 on a five year lifecycle. The IoT SKU ends 13 Jan 2032 on a ten year one.
A migration plan built on the wrong SKU is off by five years in either direction. The build number does not say which one a lane carries.
Drivers
An OPOS driver with no version of its own
One of the scanner OPOS packages on this board ships inside the vendor Scanner SDK installer, so it simply carries the SDK version, and its OPOS documentation page redirects to the SDK release notes for version detail.
Asking a site what version of the OPOS driver is installed is really asking what version of the SDK is installed.
Drivers
A documentation lag that looks like a mismatch
The JPOS page for one scanner line documents 3.07.0008 from January 2026. The SDK 3.07.0009 notes from April claim JPOS changes, and JPOS ships inside that same SDK bundle. So the installed binaries are almost certainly ahead of the page describing them.
Comparing the two documentation pages side by side produces a version mismatch that does not exist in the field.
Drivers
Two sources, one driver, two versions
For one JavaPOS package the download portal lists 1.14.089 dated 09/03/2026, while the developer documentation site for the same product names 1.14.079 as the current general availability release, undated.
The dated portal entry wins, but anyone checking the docs site first will conclude the estate is ahead of current.
Drivers
One driver name, a version per model
The Advanced Printer Driver 6 is versioned per printer model rather than globally. The TM-T88VII build is 6.10 from June 2025; the TM-m30III build is still 6.07R1.
There is no single APD version to standardise on, so a fleet baseline has to be expressed per model.
Windows
A known issue can be filed on a page the lane never reads
The Remote Desktop Services issue opened on 11 Sep 2026 lists Windows 10 Enterprise LTSC 2016, LTSC 2019, 21H2 and 22H2 among its affected platforms, but it is filed on the release health page for 1809 and Server 2019. The 21H2 page, last revised 14 Aug 2026, still shows no open issues at all.
Checking only the release health page for the build an estate runs will report clear while an issue naming that build sits on another channel's page. The affected platform list inside an issue is the authority, not the page it was filed under.
Security
The remote support flaw that points the other way
CVE-2026-84869 is in the ScreenConnect client, not the server, and it lets files be transferred and executed on the Host system through an active session without confirmation. ConnectWise states servers are unaffected.
Remote management risk is usually modelled as the server reaching down to the endpoint. Here the session is the path back to the support machine, which typically holds credentials for the whole estate.
GS1
Being an imager is necessary, not sufficient
GS1's own implementation guideline says plainly that not all imaging scanners will be capable of the 2027 goal. The real bar includes reversed reflectance handling and a decode inside 300 ms on a bioptic.
A scanner that reads a QR code on the bench can still miss the latency budget at lane speed. Spec sheet symbology lists do not answer the question.
Numbers worth distrusting
GS1
The GS1 readiness statistics are six years old
The figures that circulate in Sunrise 2027 presentations, 84 percent of retailers planning a migration and 68.5 percent still on laser scanners, come from a GS1 US and VDC study published in March 2020.
They are quoted as though they describe today. No GS1 readiness survey for 2025 or 2026 could be found at all.
GS1
There is no public scoreboard
No GS1 published survey measures POS 2D readiness, and no retailer is publicly named as live with 2D at the point of sale. The only current figure found anywhere was fewer than 20 percent of Amazon brand partners actively planning, described in its own source as one person's informal poll.
Any 2026 global adoption percentage should be met with a request for the source.
GS1
An empty list of ready vendors
GS1 publishes solution provider 2D readiness criteria and invites vendors to have their status listed. As of September 2026 the list names no companies at all.
It is self attestation rather than certification, and the list being empty means early visibility is available to anyone who asks for it.
Rules with a sting in them
Fiscal
Albania starts at the first sale
Fiskalizimi has no turnover threshold whatsoever, covers B2C including card payments, and caps offline operation at 48 hours. The tax administration states explicitly that a generic ERP connector or a Peppol access point is not sufficient.
Most market entry strategies assume a small merchant exemption to grow into. There is none here.
Fiscal
Colombia puts the tax authority on the critical path
The electronic equivalent document for POS sales must be pre-validated by DIAN before the receipt is handed to the customer. Paper contingency exists but must be transmitted within 48 hours.
Authority latency becomes checkout latency. This is an availability requirement, not just an integration.
Fiscal
Taiwan will not let the till mint an identifier
Invoice numbers for the electronic government uniform invoice are allocated centrally by the ministry. The POS draws from assigned number blocks rather than generating its own.
Number block inventory becomes a thing the POS has to manage and can run out of, which most architectures have no concept of.
Fiscal
Malaysia's rule that actually bites
Consumers who do not request an e-invoice are covered by a periodic consolidated one. From 1 Jan 2026 consolidation is prohibited for transactions above RM10,000.
The threshold turns a back office batch job into a decision the till has to make at the moment of sale.
Fiscal
South Korea issues whether or not the customer asks
In designated sectors a cash receipt must be issued automatically at KRW 100,000 and above, with an approval number fetched from the tax service, regardless of whether the customer requests one. Failure in a mandatory sector carries a 20 percent penalty.
The till needs a buyer identifier it was never designed to ask for, on a transaction the customer thinks is anonymous.
Fiscal
A VAT rate change as a firmware project
When Russian VAT moved to 22 percent on 1 Jan 2026, the tax service acknowledged that till firmware and software updates would take three to four months and instructed inspectors not to inspect during the first quarter.
Where a secure element sits inside the till, a tax rate is not configuration. It is a release.
Fiscal
Norway regulates the supplier, not the shop
Under Kassasystemlova the cash register supplier files a product declaration with the tax authority, and only declared systems may be used. The system must have an electronic journal, produce X and Z reports, export signed SAF-T Cash Register, and have no delete function at all.
It is the one obligation on this board that lands on the software vendor rather than the retailer, and it is in a market usually assumed to be unregulated.
Quietly unfixable
Security
Receipt printers answer to anyone
ESC/POS over TCP port 9100 has no authentication or encryption by design. Any host that can reach a networked Epson TM printer can send it commands. There is no CVE, no firmware fix, and none is coming: Epson's guidance is network isolation.
The whole TM line in a typical estate is an unauthenticated command endpoint. It is an architectural property, so it will never appear as a patchable finding.
Firmware
Firmware that only changes a font
The most recent releases for the Epson TM-T88VII and TM-T88VI were both Thai font redesigns, with no bug fixes and no security content.
Worth reading the release note before scheduling a fleet wide update that carries risk and delivers nothing to most estates.
Firmware
A feature that quietly disables another
Epson TM-T88VI firmware 40.60 added automatic CA signed certificate updates. Enabling it stops the printer entering power saving mode.
Buried in a release note, and the symptom appears as a power or heat complaint months later rather than as a certificate problem.
Firmware
Firmware that cannot be looked up
For one scanner line the firmware build strings appear only inside the configuration application and in quarterly release notes that are not publicly fetchable. For another, in counter scanner firmware sits behind a partner login.
Two of the four peripheral lines on this board cannot be version checked from the open web at all, which is why seven rows here say Not verified.
Windows
Ten years old and still in support
Windows 10 IoT Enterprise LTSC 2016, build 14393, was released in August 2016 and is supported until 13 Oct 2026. Its successor LTSC 2021 runs to 2032.
The ten year IoT lifecycle means a decade old build can still be fully patched, and the estate that runs it has had ten years to forget it is there.
Sources, and how to read this board
Windows lifecycle and servicing IoT Enterprise release history · Lifecycle, Win11 IoT LTSC 2024 · Lifecycle, Win11 Enterprise LTSC 2024 · KB5122878 · Known issues, LTSC 2021 · Known issues, LTSC 2019
Epson Release note PDFs on download3.ebz.epson.net and the newer download-center.epson.com. The portal index pages are blocked by robots, the ov_*.pdf notes are not, and each carries version, upload date and changelog. Advisories at wa00971, wa00977, wa00828.
Zebra Two machine readable sources, no scraping in either. Software: techdocs.zebra.com, whose /about/ pages carry version history tables. Firmware: the quarterly Evolution Update notes. Those notes are fetchable; an earlier reading that they were not came from testing off site, where the CDN answers 406. Their urls are discovered from the json feed behind that page, because the filenames and directories have changed repeatedly and cannot be constructed. Note that an older release notes page also exists but stops at version 3.0 from 2016, so it is not a usable source.
Datalogic and HP Datalogic software downloads, server rendered, so a plain GET reads all 68 entries and the category query string is only a client side filter. In counter firmware is not published there or anywhere else on the open web, re-checked 13 Sep 2026. HP ships OPOS as separate per peripheral SoftPaqs, each with its own version, read through the HPCMSL reference file.
GS1 Sunrise 2027 2D at Retail POS Implementation Guideline · POS Host and Backend Systems Playbook · Capability test suite · Solution provider readiness · GS1 Nederland. Note the gs1.nl site has been restructured and several stappenplan URLs now 404.
CVE register CISA KEV catalogue · JVNTA#97995322, ESC/POS · Epson security notifications index · ZDI Patch Tuesday review · CERT/CC VU#164934 · ConnectWise ScreenConnect bulletin, 8 Sep 2026 · Horizon3 on Simphony. Windows affected build lists were taken from the CVE Program records filed by Microsoft on 8 Sep 2026, not from a summary.
Fiscalisation, Europe GKS 2.0 Belgium · economie.gouv.fr on caisse certification · AADE Greece · Skatteetaten Norway · EU ViDA adoption · Keurmerk Afrekensystemen
Fiscalisation, rest of world ZATCA wave 25 · SUNAT Peru · Revenu Quebec · IRAS Singapore · eGov Kazakhstan · SARS consultation. Where no tax authority page was reachable, the entry rests on a big four alert or a fiscalisation specialist, and anything that could not be confirmed says so in the row.
How to read this board Every version here was taken from a vendor page or release note, with the date that page showed. A Not verified chip means the vendor does not publish the figure publicly and it was left blank rather than guessed. Fiscal entries state the position as of 12 Sep 2026; confirm against the primary text before committing engineering work.
Opticon, Newland and Honeywell Opticon downloads is the most open source of the four scanner vendors: one server rendered page, a firmware level for every current model, no login. Newland software and drivers are public direct links whose versions come from the link label or the filename; only its Ndevor device management portal needs a login. Honeywell publishes nothing readable: every route ends at hsmftp.honeywell.com behind a sign in.
We read every version here from a vendor page or release note, and we publish this board because most of it is just as true for anyone else running tills. Where we cannot confirm a level at source we mark it Not verified rather than estimating it. Talk to us about a POS estate →
We publish this in good faith and check it at source, but vendor pages move and regulations change: we cannot warrant that everything here is complete or current, and Tillforge accepts no liability for decisions taken on the basis of this page. Anything acted on should first be confirmed with the vendor or the relevant authority. See our terms.