CVE-2026-81578

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 10/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

CISA Known Exploited Vulnerability

Vendor / Product PaperCut — NG/MF

Date Added 2026-08-31

Remediation Due 2026-09-14

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81578

Weakness Classification (1)

CWE-305

Affected Software (6)

Vendor	Product	Version
papercut	papercut_mf	< 24.1.9
papercut	papercut_mf	25.0.2 – 25.0.12
papercut	papercut_mf	26.0.2 – 26.0.4
papercut	papercut_ng	< 24.1.9
papercut	papercut_ng	25.0.2 – 25.0.12
papercut	papercut_ng	26.0.2 – 26.0.4