PaperCut NG/MF CVE-2026-14780

Requires authenticated administrative access to the PaperCut NG/MF management interface (PR:H) and use of the device-scripting functionality's embedded execution engine, into which the attacker supplies a malicious script that escapes the runtime sandbox. Limiting factors: this is NOT unauthenticated - the attacker must already be an admin (or possess admin credentials/insider access) on the management console, which is the primary control that bounds real-world risk. The vendor's AT:P also indicates an additional attack precondition must be met to achieve the escape, beyond merely holding admin rights. No end-user interaction is required (UI:N).

This is a genuine high-technical-impact flaw but a low-urgency one for most defenders because exploitation is heavily gated. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H) shows full host compromise (confidentiality, integrity, availability all High) but requires PR:H - the attacker must already hold administrative access to the PaperCut management interface. This makes the vulnerability a post-authentication privilege escalation (application-admin → host OS-admin / RCE) rather than an entry point. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of widespread or automated exploitation. The realistic risk is an insider or an attacker who has already stolen/obtained admin credentials pivoting from PaperCut's app-layer control to full OS control on the print server. Note the AT:P (attack requirement) in the vendor vector implies some non-trivial precondition to trigger the sandbox escape, which further tempers ease of exploitation; the description does not spell out that condition, so verify with the PaperCut bulletin.

An attacker who has obtained administrative access to the PaperCut NG/MF management interface (via credential theft, weak/default admin passwords, or a malicious insider) navigates to the device-scripting functionality and submits a crafted script designed to break out of the runtime sandbox. On execution the script runs arbitrary operating system commands with administrative privileges on the underlying host, giving full control of the print server. No public exploit code was identified at time of analysis.