CVE-2026-81578: PaperCut NG/MF Missing Authentication Flaw Exploited, Added to CISA KEV

TL;DR

CVE-2026-81578 is a missing-authentication vulnerability in the PaperCut NG/MF web management interface that allows an unauthenticated remote attacker to modify certain system configurations, and it can be chained with CVE-2026-82078 for deeper compromise. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-31 with a remediation due date of 2026-09-14, citing confirmed exploitation. If you run PaperCut NG or MF, treat this as an urgent patch item: apply the vendor's fixed release, restrict access to the management interface, and hunt for unauthorized configuration changes today.

What is this vulnerability?

Field	Value
CVE	CVE-2026-81578
Vendor / Product	PaperCut / NG and MF
Vulnerability name	PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Weakness	CWE-306 (Missing Authentication for Critical Function)
CISA KEV added	2026-08-31
CISA KEV due date	2026-09-14
Known ransomware use	Unknown
CVSS v3.1 (NVD)	9.8 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (secondary source)	8.8 HIGH
EPSS	0.0329 (percentile 0.87876)
Chaining	Can be chained with CVE-2026-82078

Overview

CVE-2026-81578 is a missing authentication for a critical function vulnerability (CWE-306) affecting the web management interface of PaperCut NG and PaperCut MF. According to the vendor and CISA, unauthenticated remote requests that target administrative functions can cause backend actions to execute before access validation completes, allowing an attacker to modify certain system configurations without credentials. NVD rates the issue as CVSS 3.1 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while a CVSS 4.0 assessment from another source scores it 8.8 (HIGH). The vulnerability was published on 2026-08-31 and was added to the CISA Known Exploited Vulnerabilities catalog the same day, with a remediation due date of 2026-09-14. PaperCut issued an urgent security advisory on 2026-08-27, and CISA's required action references BOD 26-04 and its Forensics Triage Requirements.

Because the affected product is a print management platform that commonly sits on internal networks and is often reachable through web portals, any organization running PaperCut NG or MF should treat this as an urgent patch item. The EPSS score of 0.0329 (percentile 0.87876) suggests elevated but not extreme short-term exploitation likelihood, yet the KEV listing and public tooling references raise the practical risk for exposed instances.

The vulnerability can be chained with CVE-2026-82078, meaning an attacker may use this flaw as one stage in a broader intrusion rather than as a standalone end goal. PaperCut's urgent advisory framing, combined with CISA's BOD 26-04 references, pushed the issue into the priority patching conversation for IT and security teams. Discussion has focused on the risk of exposed print management consoles and the need to inventory PaperCut instances that may be reachable from untrusted networks. Because known ransomware use is listed as unknown, defenders should not assume the flaw is limited to espionage or nuisance activity.

Technical details

The root cause is an access control ordering flaw in the PaperCut NG/MF web management interface. Under specific conditions, unauthenticated remote requests aimed at administrative functions reach backend logic before the access validation checks complete, so the application performs privileged actions without confirming the caller's identity or authorization. This maps directly to CWE-306, missing authentication for a critical function, and the official summary describes it as an improper access control issue in the web management interface.

The attack is network-reachable (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and low complexity (AC:L), which explains the 9.8 base score. The vulnerable component is the administrative web surface rather than the print spooler or endpoint client, so the trust boundary that is crossed is the one between unauthenticated network clients and the administrative control plane.

• Affected versions: consult the PaperCut advisory for the precise fixed builds; the source intel does not specify exact affected version ranges.
• Attack prerequisites: network reachability to the PaperCut web management interface; no credentials required.
• Network exposure: the administrative web surface, commonly reachable on internal networks and through web portals.
• Authentication requirements: none — the flaw is a missing-authentication condition.
• Chaining: can be chained with CVE-2026-82078, so treat it as one stage in a broader intrusion.

No public proof-of-concept was listed in the primary source, but two public GitHub references exist, which increases the chance that opportunistic actors will test the flaw.

Impact

Successful exploitation allows an unauthenticated remote attacker to change certain system configurations on PaperCut NG/MF. Because the affected functions are administrative, integrity impact is the most immediate concern: configuration changes can alter authentication behavior, integration settings, or other control-plane values that the platform relies on. The CVSS 3.1 vector rates confidentiality, integrity, and availability all as High, while the CVSS 4.0 assessment emphasizes high integrity impact with lower confidentiality and availability impact.

In practice, defenders should assume that an attacker who can modify configuration may be able to weaken security controls, persist access, or prepare the environment for follow-on activity, especially when chained with CVE-2026-82078. Downstream abuse could include tampering with print accounting, redirecting or intercepting document workflows, or using the PaperCut host as a pivot into adjacent network segments.

Business exposure includes operational disruption to print and copy services, potential exposure of documents and directory data, and compliance consequences if the KEV deadline is missed. Because PaperCut is often integrated with Active Directory and other identity systems, configuration tampering can have effects beyond the print environment itself.

Exploitability

CVE-2026-81578 was added to the CISA KEV catalog on 2026-08-31, the same day it was published, which signals confirmed exploitation in the wild. The EPSS score of 0.0329 (percentile 0.87876) suggests elevated but not extreme short-term exploitation likelihood, yet the KEV listing and public tooling references raise the practical risk for exposed instances. Two public GitHub repositories reference CVE-2026-81578 and CVE-2026-82078, indicating active researcher and attacker interest. The vulnerability can be chained with CVE-2026-82078, meaning an attacker may use this flaw as one stage in a broader intrusion rather than as a standalone end goal. Known ransomware use is listed as unknown, so defenders should not assume the flaw is limited to espionage or nuisance activity.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed exploitation in the wild	Treat as urgent; remediate by 2026-09-14 per BOD 26-04
CVSS v3.1 (9.8)	Technical severity of the flaw	Prioritize patching; network-reachable, no auth required
CVSS v4.0 (8.8)	Severity with updated scoring	Confirms high integrity impact; supports urgent patching
EPSS (0.0329 / 87.9th percentile)	Short-term exploitation likelihood	Elevated but not extreme; KEV status overrides for prioritization

Exploitation steps (defensive triage)

1. Identify internet- or intranet-exposed PaperCut NG/MF web management interfaces, including non-standard ports and reverse-proxy paths that forward to the admin console.
2. Confirm the running PaperCut version and build against the vendor advisory to determine whether the instance is in the affected range.
3. Review web server and application logs for unauthenticated requests to administrative endpoints that returned success or triggered backend actions.
4. Look for configuration changes that were not made by a known administrator, especially changes to authentication, integration, or security-related settings.
5. Correlate any suspicious configuration activity with requests associated with CVE-2026-82078 to determine whether chaining occurred.
6. Check for public tooling references and known user-agent or path patterns from the two GitHub repositories, and hunt for those patterns in historical logs.
7. If compromise is suspected, isolate the PaperCut host, preserve logs and configuration snapshots, and begin incident response before restoring service.
8. Apply the vendor fix or documented mitigations, then re-verify configuration integrity and monitor for recurrence.

Indicators of compromise

• Unauthenticated POST or PUT requests to PaperCut administrative endpoints that return HTTP 200 or otherwise indicate success.
• Configuration changes in PaperCut audit or admin logs that lack a corresponding authenticated administrator session.
• Requests to admin paths from IP addresses or geographies that do not match normal administrative access patterns.
• User-agent strings or request paths associated with the public GitHub tooling references for CVE-2026-81578 and CVE-2026-82078.
• Unexpected modifications to authentication, LDAP/Active Directory integration, SMTP, or web security settings.
• New or altered administrative accounts, API keys, or integration credentials on the PaperCut host.
• Anomalous outbound connections from the PaperCut server to unfamiliar hosts, which may indicate post-exploitation activity.
• Web server error logs showing access validation failures or ordering anomalies around administrative functions.
• Sudden changes in print accounting, quota, or billing configuration that cannot be tied to a change ticket.

Mitigation and workarounds

Apply the fixed PaperCut NG/MF release identified in the vendor's urgent security advisory as soon as possible, and treat the CISA KEV due date of 2026-09-14 as a hard internal deadline. Follow CISA's required action and BOD 26-04 guidance, including the Forensics Triage Requirements, and evaluate each asset's internet exposure.

If a patch cannot be applied immediately, restrict access to the web management interface using network controls, allowlists, or a VPN, and disable or block administrative endpoints from untrusted networks. Review PaperCut documentation for any vendor-provided workarounds or configuration hardening steps, and consider temporarily disabling non-essential integrations while remediation is pending.

After patching, verify that no unauthorized configuration changes remain, rotate credentials and API keys that may have been exposed, and monitor for re-exploitation. Organizations that cannot mitigate should follow BOD 26-04 guidance for cloud services or discontinue use of the product until a fix is available.

Community reactions

The vulnerability drew attention primarily because of its rapid addition to the CISA KEV catalog on the same day it was published, which signals confirmed exploitation in the wild. Security media and community trackers highlighted the CVSS 9.8 rating and the missing-authentication nature of the flaw, and the existence of two public GitHub repositories referencing CVE-2026-81578 and CVE-2026-82078 suggests active researcher and attacker interest. PaperCut's urgent advisory framing, combined with CISA's BOD 26-04 references, pushed the issue into the priority patching conversation for IT and security teams. Discussion has focused on the risk of exposed print management consoles and the need to inventory PaperCut instances that may be reachable from untrusted networks. Because known ransomware use is listed as unknown, defenders should not assume the flaw is limited to espionage or nuisance activity.

FAQ

Is CVE-2026-81578 in the CISA KEV catalog? Yes. CISA added it on 2026-08-31, citing confirmed exploitation in the wild.

What is the CISA remediation due date? The due date is 2026-09-14. Federal agencies must remediate by then under BOD 26-04; other organizations should treat it as a hard internal deadline.

Is PaperCut NG/MF internet-facing by default? PaperCut is often deployed on internal networks but can be reachable through web portals or reverse proxies. Evaluate each asset's exposure and restrict the management interface to trusted networks.

Which products are affected? PaperCut NG and PaperCut MF. Consult the vendor advisory for the precise affected version ranges and fixed builds.

How do I verify remediation? Confirm the running build matches the vendor's fixed release, re-check configuration integrity, rotate exposed credentials, and monitor logs for recurrence.

Can this be chained with another vulnerability? Yes. CVE-2026-81578 can be chained with CVE-2026-82078, so treat it as one stage in a broader intrusion.

What is the CVSS score? NVD rates it 9.8 (CRITICAL) under CVSS 3.1; a secondary CVSS 4.0 assessment scores it 8.8 (HIGH).

Related resources

• PaperCut urgent security advisory
• CISA BOD 26-04 Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD entry for CVE-2026-81578
• Public GitHub reference
• Public GitHub reference