CVE-2026-81578PaperCut MF/NG: Authentication Bypass

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

8.8 HIGHEPSS 84.73%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-09-14 00:16 UTC

OverviewCVSS details

8.8HIGHCVSS 4.0

Score source: PaperCut (CNA)
NVD status: Analyzed
Published: Aug 28, 2026
Assigner: PaperCut

Affected

PaperCut MF/NG (PaperCut)

Versions: before 24.1.10 · 25.0.0 before 25.0.13
Fixed in: 24.1.10, 25.0.13, 26.0.5

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Aug 31, 2026
KEV due date: Sep 14, 2026
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 7

84.73%chance of exploitation in 30 days

Higher than 99.70% of CVEs

CVSS 4.0 · PaperCut (CNA)

8.8High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: Low
Integrity impact: High
Availability impact: Low
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.8	HIGH	4.0PaperCut (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Sep 14, 2026

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Details

CVE ID: CVE-2026-81578
Status: Analyzed
Assigner (CNA): PaperCut
Published: Aug 28, 2026
Last modified: 2026-09-14 00:16 UTC
Weaknesses: CWE-305 · Authentication bypass by primary weakness
CWE-306

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:11 UTC.