CVE-2026-81578: PaperCut MF/NG: Authentication Bypass
Published Aug 28, 2026
·Updated
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Affected Software
2 affected components
PaperCut MF
PaperCut NG
Event History
Aug 28, 2026
CVE Published
via MITRE·11:39 AM
Data Sourced
via MITRE·11:39 AM
DescriptionWeakness
Frequently Asked Questions
1
Does exploitation require valid PaperCut credentials or local access?
No. The issue can be triggered by unauthenticated remote requests targeting administrative functions in the web management interface.
2
Which installations should be considered potentially exposed?
PaperCut MF and PaperCut NG installations with the web management interface reachable by remote attackers should be considered potentially exposed. The specific conditions required for exploitation are not provided.