PaperCut NG - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper...

CVE-2026-8793

CVE-2026-8793 — PaperCut NG 登录表单缺少暴力破解防护 字段| 详细信息 ---|--- CVE ID| CVE-2026-8793 产品| PaperCut NG 受影响版本| 25.0.11 Build 75758 及更早版本 CWE| CWE-307 — 对过多身份验证尝试的限制不当 CVSS 评分| 5.3（中危）— 独立利用时；与 CVE-2026-8794 链式利用时可升级 研究人员| Vivien LEBAS @Hazaz 报告时间| 2026年5月 状态| 已修复 — PaperCut NG 26.0.3 摘要 PaperCut NG 的 Web...

CVE-2023-27350

CVE-2023-27350 이 취약점은 원격 공격자가 PaperCut NG 22.0.5 Build 63914의 영향을 받는 설치에서 인증을 우회할 수 있게 합니다. 이 취약점을 악용하기 위해 인증은 필요하지 않습니다. 특정 결함은 SetupCompleted 클래스에 존재합니다. 이 문제는 부적절한 접근 제어로 인해 발생합니다. 공격자는 이 취약점을 악용하여 인증을 우회하고 SYSTEM 컨텍스트에서 임의 코드를 실행할 수 있습니다. ZDI-CAN-18987이었습니다...

CVE-2026-8794

CVE-2026-8794 — PaperCut NG における認証タイミングサイドチャネルを介したユーザー名列挙 フィールド| 詳細 ---|--- CVE ID| CVE-2026-8794 製品| PaperCut NG 影響を受けるバージョン| 25.0.11 ビルド 75758 以前 CWE| CWE-208 — 観察可能なタイミング不一致 CVSS スコア| 3.7 低 — 単独の場合。CVE-2026-8793 と連鎖すると深刻度が上昇 研究者| Vivien LEBAS @Hazaz 報告日| 2026年5月 ステータス| 修正済み — PaperCut NG 26.0....

PaperCut-CVE-2026-81578-82078

PaperCut NG/MF の脆弱性評価および許可された悪用テストのためのプロフェッショナルなセキュリティ調査ツール root@kitploit: ╔══════════════════════════════════════════════════════════════════╗ ║ PAPERCUT SECURITY TOOL – POWER MODE ║ ║ CVE-2026-81578 · CVE-2026-82078 · v3.1.0 ║ ║ ⚡ powered by yora 1928 ⚡ ║...

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and...

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence AI to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and...

CVE-2023-27350

PaperCut NG/MG リモートコード実行 CVE-2023-27350 CVE-2023-27350 向けの効率的な Bash エクスプロイトです。このスクリプトは、PaperCut プリンタースクリプトエンジンを介して、認証バイパス、環境準備、コマンドインジェクションを自動化します。 ビジュアル証明 基本 RCE: リバースシェルのトリガー: クイックスタート root@kitploit: Clone the repository git clone https://github.com/dezso-dfield/CVE-2023-27350.git Enter the...

PaperCut-Authentication_Bypass_and_RCE

CVE-2023-27350 — PaperCut NG/MF 认证绕过与远程代码执行 针对 PaperCut NG/MF 中关键认证绕过和远程代码执行漏洞的独立 Python 利用工具。CVSS 评分 9.8。 描述 CVE-2023-27350 影响 20.1.7、21.2.11 和 22.0.9 之前的 PaperCut NG 和 MF 版本。该漏洞允许未经身份验证的攻击者访问 /app?service=page/SetupCompleted 端点——一个本应仅在初始安装期间可访问的设置页面——并在没有任何凭据的情况下获取有效的管理会话。 拥有管理员权限后，攻击者可以启用...

VulnCheck KEV: CVE-2023-39470

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists with...

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

CVE-2026-82078

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of...

PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510, or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

VulnCheck KEV: CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

PT-2026-83117

Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An improper access control issue exists in the web management interface. Under specific conditions, unauthenticated remote requests targeting...