CVE-2026-81578

EUVD-2026-67713
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the  completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99.72%
Affected Products (NVD)
VendorProductVersion
papercutpapercut_mf
𝑥
< 24.1.9
papercutpapercut_mf
25.0.2 ≤
𝑥
< 25.0.12
papercutpapercut_mf
26.0.2 ≤
𝑥
< 26.0.4
papercutpapercut_ng
𝑥
< 24.1.9
papercutpapercut_ng
25.0.2 ≤
𝑥
< 25.0.12
papercutpapercut_ng
26.0.2 ≤
𝑥
< 26.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
https://github.com/rapid7/metasploit-framework/pull/21842
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578