THREAT OPS › CVEs › CVE-2026-81578
CVE-2026-81578 — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
Vulnerability details
- Affected productsNG/MF
- KEV remediation due2026-09-14
Related reporting
- [NVD] CVE-2026-81578 (CRITICAL 9.8) — An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation nvd
- Metasploit Wrap Up: This One Goes to Sixteen!rapid7
- August 2026 CVE Landscaperecordedfuture
- Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universitiesthehackernews
- CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilitieshorizon3
- PaperCut RCE Chain: CVE-2026-82078 Exploitedsocradar_blog
- CISA Adds Two Known Exploited Vulnerabilities to Catalogcisa_advisories
- [CISA KEV] CVE-2026-82078 — PaperCut NG/MF: PaperCut NG/MF Unsafe Reflection Vulnerabilitycisa_kev
- [CISA KEV] CVE-2026-81578 — PaperCut NG/MF: PaperCut NG/MF Missing Authentication for Critical Function Vulnerabilitycisa_kev
- 31th August – Threat Intelligence Reportcheckpoint_research
- PaperCut Multiple Vulnerabilitieshkcert