PaperCut NG/MF CVE-2026-8794

No authentication is required and no special configuration is needed - the timing oracle is a structural property of the authentication flow present across all instances of the affected product. The attack requires unauthenticated network access to the PaperCut NG/MF web login endpoint over HTTP or HTTPS. Exploitation is constrained in practice by network latency variability: high-latency or noisy WAN connections obscure timing differences, requiring larger sample sizes per username to achieve statistical confidence; attackers on low-latency paths (LAN, co-located infrastructure, or cloud environments near the target) face significantly less friction. No specific feature flag, non-default configuration, or authentication session is required to trigger the vulnerable code path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) accurately reflects a low-friction remote unauthenticated attack with constrained impact: only username existence is leaked, not credentials or data. The SC:L (subsequent-system confidentiality) metric acknowledges that discovered valid usernames enable downstream attacks such as credential stuffing, targeted phishing, or password spraying. No EPSS data was provided, and no KEV listing exists, suggesting this is not currently being exploited at scale. Real-world risk is moderate rather than critical: the vulnerability alone does not grant access but materially reduces the cost of follow-on credential attacks. PaperCut as a platform has been a high-value target historically (it manages privileged print infrastructure and integrates with Active Directory), which elevates the strategic value of valid account lists. Network latency variability is a practical constraint on timing attack precision over WAN paths, but LAN-adjacent attackers or those with low-latency positioning face minimal barriers. No conflicting signals exist in the provided data; the vendor self-reported and the CVSS vector is internally consistent with the description.

An unauthenticated attacker with network access to the PaperCut web login endpoint submits authentication requests using a wordlist of common or organization-specific usernames and records server response times for each. By statistically aggregating multiple measurements per candidate to smooth network jitter, the attacker distinguishes valid accounts (slower, due to hash comparison) from invalid ones (faster, short-circuit). The resulting confirmed username list is then used as input for credential stuffing or targeted phishing against PaperCut or integrated directory services.