CVE-2026-81578

Think of PaperCut’s web admin page like the control room for your print/account settings. This bug lets someone outside the building trick the system into letting them change certain important settings without ever logging in. In real attacks, this is being used to take over or reshape the server configuration.

This matters if your organization uses PaperCut MF/NG on a server that exposes the PaperCut web management interface to the network. It’s especially risky if that web admin page is reachable from the internet. The reachability condition from the findings is: only a risk if an attacker can send unauthenticated requests to the PaperCut web management interface over the network.

This is RED because exploitation has been reported in the wild, and attackers are using the bypass to tamper with server configuration on customer systems. The issue is reachable without authentication and, per the findings, is enabled under default configuration. Act immediately to upgrade to a fixed version and remove internet reachability to the management interface.

1. Confirm exposure

   • Identify whether PaperCut MF/NG is installed on a server you manage.
   • Determine the exact installed version (from PaperCut admin/about or your software inventory).
   • Verify whether the PaperCut web management interface is reachable from the internet (external scanning is not required—check your firewall rules, public DNS/ports, load balancer rules, and whether any reverse proxy forwards to the admin UI).

2. Decide your upgrade target (fixed versions)

   • If on PaperCut MF/NG 24.x: upgrade to 24.1.10 or later.
   • If on PaperCut MF/NG 25.x: upgrade to 25.0.13 or later.
   • If on PaperCut MF/NG 26.x: upgrade to 26.0.5 or later.

3. Upgrade plan

   • Schedule downtime if your change process requires it (PaperCut upgrades often involve restarting services).
   • Apply the upgrade to the server(s) running PaperCut MF/NG.
   • After upgrade, re-check the installed version to confirm you are on one of the fixed releases.

4. Temporary workaround if patching is delayed

   • Block all inbound internet access to the PaperCut web management interface.
   • Allow access only from trusted internal networks/IPs used by your admins.
   • If you use a reverse proxy or WAF, ensure it only permits admin UI paths from approved sources.

5. What to monitor

   • Look for unusual admin/configuration changes around the time of the incident window.
   • Review web/admin access logs for unauthenticated or abnormal request patterns targeting login/admin-related endpoints.
   • If you have EDR/server logs, check for follow-on activity consistent with configuration manipulation (especially because exploitation reports mention chaining with CVE-2026-82078).

Severity and status: This is a confirmed-in-the-wild style issue per the provided reporting, and the overall verdict is RED.

Weakness/Mechanism: CWE-305 (Improper Access Control). The findings describe a timing issue in the website’s login check that allows unauthenticated remote requests to trigger backend administrative actions before access validation completes.

Attack vector: Network access to the PaperCut MF/NG web management interface, without authentication and without user interaction.

Preconditions / reachability: The attacker must be able to send unauthenticated remote requests to the web management interface. The findings indicate it is reachable in default configuration.

Exploitation maturity: Exploitation in the wild has been reported. The news summary states exploitation involves chaining with a separate flaw (CVE-2026-82078) to manipulate server configuration and mentions unauthenticated attackers achieving arbitrary code execution via the chain.

KEV: Not listed in CISA KEV (per findings), but active exploitation is still reported.

Fix availability: Fixed in 24.1.10, 25.0.13, and 26.0.5 per the provided patch findings.