Skip to main content

PaperCut NG/MF CVE-2026-8794

| EUVDEUVD-2026-52225 MEDIUM
Observable Timing Discrepancy (CWE-208)
2026-08-03 PaperCut GHSA-56w5-2p66-mx39
Information Disclosure Oracle Papercut Ng Mf
6.9
CVSS 4.0 · Vendor: PaperCut
Share

Severity by source

Vendor (PaperCut) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable unauthenticated login endpoint; confidentiality impact limited to account existence; no integrity or availability impact; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (PaperCut).

CVSS VectorVendor: PaperCut

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 03, 2026 - 09:02 EUVD
Analysis Generated
Aug 03, 2026 - 08:21 vuln.today
CVE Published
Aug 03, 2026 - 07:02 cve.org
MEDIUM 6.9

DescriptionCVE.org

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

AnalysisAI

Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component, exploitable by unauthenticated remote attackers. The system conditionally executes password hash comparison only when a submitted username corresponds to a valid account, producing a measurable latency difference that reveals account existence. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify PaperCut login endpoint
Delivery
Submit candidate usernames with no credentials
Exploit
Measure authentication response latency per attempt
Execution
Repeat to average out network jitter
Persist
Identify valid accounts via statistically significant timing delta
Impact
Use confirmed usernames for credential stuffing or phishing
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required and no special configuration is needed - the timing oracle is a structural property of the authentication flow present across all instances of the affected product. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) accurately reflects a low-friction remote unauthenticated attack with constrained impact: only username existence is leaked, not credentials or data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker with network access to the PaperCut web login endpoint submits authentication requests using a wordlist of common or organization-specific usernames and records server response times for each. By statistically aggregating multiple measurements per candidate to smooth network jitter, the attacker distinguishes valid accounts (slower, due to hash comparison) from invalid ones (faster, short-circuit). …
Remediation Consult the PaperCut security bulletin at https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/ for the specific patched version and upgrade path - no exact fix version is confirmed in the currently available data, so the bulletin is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Papercut Ng Mf

View all
CVE-2026-8793 MEDIUM
6.9 Aug 03

PaperCut NG/MF's login component fails to enforce account lockout or rate-limiting controls in certain configurations, a
CVE-2026-6418 MEDIUM
4.6 May 05

PaperCut MF version 25.0.4 allows authenticated administrators to read arbitrary files on the server through insufficien
CVE-2026-5115 LOW
3.6 Mar 31

PaperCut NG/MF embedded application on Konica Minolta multifunction devices transmits sensitive session data over an ins
CVE-2026-4794 LOW
2.1 Mar 31

Stored cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF versions before 25.0.10 allow authenticated administ

Same weakness CWE-208 – Observable Timing Discrepancy

View all
CVE-2026-23519 CRITICAL POC
9.8
CVE-2024-47178 HIGH POC
8.7
CVE-2026-69247 HIGH POC
8.2
CVE-2025-68621 HIGH POC
7.4
CVE-2024-7010 MEDIUM POC
5.9
CVE-2021-26314 MEDIUM POC
5.5
CVE-2026-23849 MEDIUM POC
5.3
CVE-2025-30344 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-8794 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy