PaperCut Hive CVE-2026-11744

Requires physical access to a Ricoh device running the PaperCut Hive embedded application AND a specially crafted NFC card or NFC emulator that the device reads. Exploitation depends on the device supporting/using NFC card authentication (a configured deployment feature), and the injected payload only executes within the application's web view UI context - there is no remote or network path. Limiting factors: physical presence at the device, an NFC-capable and NFC-enabled configuration, and impact scoped to the app UI rather than the underlying OS. Exploit maturity is Unproven with no public exploit code.

Real-world risk is LOW despite the alarming 'arbitrary code execution' phrasing in the description. The vendor CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:N/VC:H/VI:L/VA:N) yields only 3.8 because the attack vector is Physical (AV:P) - the attacker must be standing at the Ricoh multifunction device with a crafted NFC card or emulator. This physical-proximity requirement is the dominant risk-limiting factor and cannot be exploited remotely or at scale. Exploit maturity is explicitly Unproven (E:U in the vector), no CISA KEV listing is present, no EPSS score was provided, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' The CWE-79 (XSS) classification is consistent with the description's 'execute arbitrary code within the context of the application's user interface' (i.e., script execution inside the embedded web view, not OS-level code execution), which makes the 'RCE' tag potentially overstated. The signals are internally consistent: high-CVSS narrative language but low actual base score driven by physical access. This is NOT a priority-patch scenario for most environments - it is a physical/insider-threat consideration for shared kiosk-style MFP deployments.

An attacker with physical access to a Ricoh MFP running PaperCut Hive taps a specially crafted NFC card (or NFC emulator) that carries an unsanitized payload; during card-read processing the payload is passed unfiltered into the device's web view, executing attacker-controlled script in the UI context. This could surface other users' print data or trigger unauthorized actions at the panel. No public exploit code is identified, and exploit maturity is rated Unproven.