SecAlerts
P

PaperCut

Security Risk Profile

55
/100
medium

Security Risk Score

Comprehensive risk assessment based on 76 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 22, 2014 to present

76
Total CVEs
27
Critical+High
7
Exploited
27
Unpatched

Threat Assessment

Avg CVSS
7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
27
Critical/High
Risk Level
55/100
medium
⚠️ 7 Active Exploits⚡ 1 Zero-Days🆕 2Fresh (<7d)📈 6 in Last 30 Days

Severity Distribution

Critical
6
High
21
Medium
15
Low
4

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
12

Age Distribution

Common Weaknesses (CWE)

1
XSS
4
2
Path Traversal
3
3
CSRF
3
4
Input Validation
2
5
Code Injection
2

Most Affected Products

1. PaperCut PaperCut MF100
2. PaperCut PaperCut NG98
3. PaperCut NG26
4. PaperCut NG/MF13
5. PaperCut MF8

Recent Vulnerabilities

See more →
https://reddit.com/r/netsec/comments/1x1squu/death_by_a_thousand_papercuts_papercut_preauth/
unknown

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs

Oct 9, 2026🔧 No Patch
https://reddit.com/r/cybersecurity/comments/1x1sqtr/death_by_a_thousand_papercuts_papercut_preauth/
unknown

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs

Oct 9, 2026🔧 No Patch
CVE-2026-11744
CVSS 3.8low

PaperCut Hive Embedded App for Ricoh: Javascript injection

Sep 24, 2026🔧 No Patch
CVE-2026-87739
CVSS 6.9medium

PaperCut MF/NG: User permissions are not evaluated on report generation

Sep 24, 2026🔧 No Patch
CVE-2026-82077
CVSS 7.3high

PaperCut NG/MF: Remote Code Execution via Scan2Fax

Sep 24, 2026🔧 No Patch
CVE-2026-14780
CVSS 7.5high

PaperCut NG/MF: Remote Code Execution via Scripting Subsystem

Sep 24, 2026🔧 No Patch
bleepingcomputer-20260828190826
unknown

PaperCut releases second emergency patch for exploited flaws

Aug 28, 2026⚠ Exploited⚡ Zero-Day🔧 No Patch
CVE-2026-82078
CVSS 9.4critical

PaperCut NG/MF Unsafe Reflection Vulnerability

Aug 28, 2026⚠ Exploited🔧 No Patch
CVE-2026-81578
CVSS 8.8high

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

Aug 28, 2026⚠ Exploited🔧 No Patch
CVE-2026-8793
CVSS 6.9EPSS 0%medium

PaperCut NG/MF: Insufficient brute-force protection

Aug 3, 2026🔧 No Patch

Monitor PaperCut in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.