by Kastro
Paper/Archive/CVE-2026-81578

CVE-2026-81578

PaperCut PaperCut MF/NG — PaperCut MF/NG: Authentication Bypass

KEV · due 14 SepEPSS 85%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

Affected

ProductAffectedFixed inSource
PaperCut MF/NG< 24.1.1024.1.10CNA
PaperCut MF/NG25.0.0 – < 25.0.1325.0.13CNA
PaperCut MF/NG26.0.0 – < 26.0.526.0.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PaperCut (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

refpapercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisoryexploitgithub.com/rapid7/metasploit-framework/pull/21842refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578kevcisa.gov/known-exploited-vulnerabilities-catalog