CRITICAL
CVE-2026-81578
CVSS
9.8
KEV
Description
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Weakness (CWE)
CWE-305
EPSS Score
3.29%
Probability of exploitation in next 30 days
87.9th percentile
References
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
Patch, Vendor Advisory
https://github.com/rapid7/metasploit-framework/pull/21842
Issue Tracking, Patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578
Patch, Third Party Advisory, US Government Resource
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.