CVE-2026-81578

PaperCut MF/NG: Authentication Bypass

Exploited in the wild. In CISA KEV since 2026‑08‑31. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile99th86% chance in 30 days CISA KEVListedsince 2026-08-31, due 2026-09-14
No public exploit known Fix3 products4 fixed builds listed below

Published 2026-08-28Updated 2026-09-14Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

PaperCut MF/NGAffected: < 24.1.10Upgrade to: 24.1.10Affected: ≥ 25.0.0, < 25.0.13Upgrade to: 25.0.13Affected: ≥ 26.0.0, < 26.0.5Upgrade to: 26.0.5Stated by: CVE record
Papercut MfAffected: < 24.1.9Upgrade to: 24.1.9Stated by: NVD
Papercut NgAffected: < 24.1.9Upgrade to: 24.1.9Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run PaperCut MF/NG and the installed version by looking in the PaperCut admin/help/about page or your server’s application inventory.
If your version is earlier than 24.1.10, upgrade to 24.1.10.
If your version is earlier than 25.0.13, upgrade to 25.0.13.
If your version is earlier than 26.0.5, upgrade to 26.0.5.
Until you upgrade, restrict network access to the PaperCut web management interface so only trusted internal IPs can reach it (block internet access).

Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

6 publishers

Technical analysis published
as reported · Oct 9, 2026·watchTowr Labs summary
Exploitation reported in the wild
as reported · Sep 16, 2026·Хакер (xakep.ru) summary
Vendor patch released
as reported · Sep 11, 2026·The Hacker News summary
Added to CISA KEV catalog
Aug 31, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

In plain language

Written by AI from the record

This PaperCut MF/NG flaw lets outsiders change server settings without logging in, and it’s already being exploited in real attacks—so typical small businesses should act urgently if you use PaperCut.

In PaperCut MF/NG web management interface, a timing/access-control weakness (CWE-305) allows unauthenticated remote requests to bypass login checks and trigger backend administrative actions that modify server configuration; exploitation in the wild has been reported.

If you're affected

Server settings tampering
Unauthorized code execution risk
Service disruption
Account and system compromise

What is it

Think of PaperCut’s web admin page like the control room for your print/account settings. This bug lets someone outside the building trick the system into letting them change certain important settings without ever logging in. In real attacks, this is being used to take over or reshape the server configuration.

Who is affected

This matters if your organization uses PaperCut MF/NG on a server that exposes the PaperCut web management interface to the network. It’s especially risky if that web admin page is reachable from the internet. The reachability condition from the findings is: only a risk if an attacker can send unauthenticated requests to the PaperCut web management interface over the network.

How urgent is it

This is RED because exploitation has been reported in the wild, and attackers are using the bypass to tamper with server configuration on customer systems. The issue is reachable without authentication and, per the findings, is enabled under default configuration. Act immediately to upgrade to a fixed version and remove internet reachability to the management interface.

What to do — in detail

Confirm exposure
- Identify whether PaperCut MF/NG is installed on a server you manage.
- Determine the exact installed version (from PaperCut admin/about or your software inventory).
- Verify whether the PaperCut web management interface is reachable from the internet (external scanning is not required—check your firewall rules, public DNS/ports, load balancer rules, and whether any reverse proxy forwards to the admin UI).
Decide your upgrade target (fixed versions)
- If on PaperCut MF/NG 24.x: upgrade to 24.1.10 or later.
- If on PaperCut MF/NG 25.x: upgrade to 25.0.13 or later.
- If on PaperCut MF/NG 26.x: upgrade to 26.0.5 or later.
Upgrade plan
- Schedule downtime if your change process requires it (PaperCut upgrades often involve restarting services).
- Apply the upgrade to the server(s) running PaperCut MF/NG.
- After upgrade, re-check the installed version to confirm you are on one of the fixed releases.
Temporary workaround if patching is delayed
- Block all inbound internet access to the PaperCut web management interface.
- Allow access only from trusted internal networks/IPs used by your admins.
- If you use a reverse proxy or WAF, ensure it only permits admin UI paths from approved sources.
What to monitor
- Look for unusual admin/configuration changes around the time of the incident window.
- Review web/admin access logs for unauthenticated or abnormal request patterns targeting login/admin-related endpoints.
- If you have EDR/server logs, check for follow-on activity consistent with configuration manipulation (especially because exploitation reports mention chaining with CVE-2026-82078).

Technical context

Severity and status: This is a confirmed-in-the-wild style issue per the provided reporting, and the overall verdict is RED.

Weakness/Mechanism: CWE-305 (Improper Access Control). The findings describe a timing issue in the website’s login check that allows unauthenticated remote requests to trigger backend administrative actions before access validation completes.

Attack vector: Network access to the PaperCut MF/NG web management interface, without authentication and without user interaction.

Preconditions / reachability: The attacker must be able to send unauthenticated remote requests to the web management interface. The findings indicate it is reachable in default configuration.

Exploitation maturity: Exploitation in the wild has been reported. The news summary states exploitation involves chaining with a separate flaw (CVE-2026-82078) to manipulate server configuration and mentions unauthenticated attackers achieving arbitrary code execution via the chain.

KEV: Not listed in CISA KEV (per findings), but active exploitation is still reported.

Fix availability: Fixed in 24.1.10, 25.0.13, and 26.0.5 per the provided patch findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-08-31.

US federal agencies must remediate by 2026-09-14.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

86% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

19 events over 33 days, from the signal feeds we watch.

2026-09-30EPSS band changelow → highepss band change
2026-09-28Analysis publishedPaperCut: Two Emergency Patches, Then an Agent Swarm Hit 395 Organizations
2026-09-15Nuclei check added
2026-09-14Patch availablerecord updated
2026-09-01Patch availablerecord updated
2026-08-31Added to CISA KEVpatch available, record updated, record updated

Affected products

PaperCutcommercial · USaka paper cut
- papercut mfDesktop AppOn-premSecurity Products / vuln-mgmt-scanner
- papercut ngDesktop AppOn-premSecurity Products / vuln-mgmt-scanner
- PaperCut MF/NGMixedSecurity Products / secure-gateway-vpn

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable