CVE-2026-81578: PaperCut NG/MF Unauthenticated Admin Config Bypass (KEV)

Checked: 2026-10-29

CVE-2026-81578 is a missing-authentication-for-critical-function flaw in the web management interface of PaperCut NG/MF that lets an unauthenticated remote attacker trigger administrative backend actions and modify system configuration before access checks complete, and PaperCut's own advisory confirms it ships in the same emergency bulletin as the more severe unsafe-class-loading RCE tracked as CVE-2026-82078, which CISA's KEV entry says it can be chained with.

Vulnerability summary

Vulnerability ID	CVE-2026-81578
CVSS score	9.8
EPSS score	0.83729
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2026-08-28T16:18:29.600

Affected components

Component	CPE	Version range
PaperCut NG / PaperCut MF	cpe:2.3:a:papercut:papercut_ng::::::::	Before 24.1.9; 25.0.2 through 25.0.11 (fixed in 25.0.12); 26.0.2 through 26.0.3 (fixed in 26.0.4), per NVD's configuration data. PaperCut's own download page lists the current emergency-patch builds as 24.1.10, 25.0.13 and 26.0.5 — one cumulative release ahead of NVD's fixed-in boundary as of this writing.

What this means

CVE-2026-81578 is a Missing Authentication for Critical Function (CWE-305/CWE-306) vulnerability in PaperCut NG and PaperCut MF. NVD's description states: "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations" (NVD).

NVD's own Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, high impact across confidentiality, integrity and availability. PaperCut's own CNA submission separately rates the same flaw 8.8 (high) under CVSS v4.0, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N — the lower figure reflects the different CVSS v4.0 methodology (limited confidentiality/availability impact, high integrity impact) rather than a disagreement over severity (NVD).

PaperCut's own security bulletin, published 27 August 2026, confirms this is one of two CVEs disclosed together: CVE-2026-81578 ("Authentication Bypass", 8.8 HIGH under PaperCut's own CVSS v4.0 scoring) and CVE-2026-82078 ("Unsafe Dynamic Class Loading in Database Connector", 9.4 CRITICAL), both affecting "all versions of PaperCut NG, PaperCut MF" and both mitigated in the PaperCut NG/MF Emergency Patch. The bulletin's current download table lists the patched builds as v26.0.5, v25.0.13 and v24.1.10 (PaperCut Security Bulletin).

CISA added CVE-2026-81578 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-31, with a required-action due date of 2026-09-14, and its short description explicitly notes "this vulnerability can be chained with CVE-2026-82078" — consistent with PaperCut's own framing of the two flaws as a combined authentication-bypass-to-RCE chain. Known ransomware campaign use is recorded as "Unknown" and forensic triage is not separately required. Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.83729 (99.686th percentile) — a very high score consistent with a KEV-listed, unauthenticated, network-reachable flaw in widely deployed print-management software (FIRST EPSS).

Any PaperCut NG/MF deployment should be upgraded to the current emergency-patch release (26.0.5, 25.0.13 or 24.1.10, or later) immediately, with particular urgency given CVE-2026-81578 can reportedly be chained with the critical CVE-2026-82078 class-loading RCE from the same bulletin.

How to fix this class of issueThis advisory's weakness class is Authentication bypass. Our practical guide covers how to detect, fix, verify and disclose it: How to fix authentication bypass in embedded firmware.

Evidence

Improper access control in the PaperCut NG/MF web management interface lets unauthenticated remote requests trigger administrative backend actions before access-validation checks complete, allowing modification of system configuration. — NVD
NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; PaperCut's own CNA submission separately rates it 8.8 under CVSS v4.0 due to the different scoring methodology. — NVD
PaperCut's 27 August 2026 bulletin confirms CVE-2026-81578 (Authentication Bypass, 8.8 HIGH) ships alongside CVE-2026-82078 (Unsafe Dynamic Class Loading, 9.4 CRITICAL), affects all versions of PaperCut NG/MF, and is mitigated in the Emergency Patch; current downloads are v26.0.5, v25.0.13 and v24.1.10. — PaperCut Security Bulletin
Added to the CISA KEV catalog on 2026-08-31, due date 2026-09-14, noted as chainable with CVE-2026-82078, ransomware use Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
EPSS score is 0.83729 (99.686th percentile) as of 2026-10-28. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.