Skip to main content

PaperCut NG/MF EUVDEUVD-2026-52224

| CVE-2026-8793 MEDIUM
Improper Restriction of Excessive Authentication Attempts (CWE-307)
2026-08-03 PaperCut GHSA-845j-gc55-fc8w
Information Disclosure Papercut Ng Mf
6.9
CVSS 4.0 · Vendor: PaperCut
Share

Severity by source

Vendor (PaperCut) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H reflects the required absent-lockout configuration prerequisite; AV:N and PR:N per vendor CVSS 4.0; C:L for credential enumeration, no I or A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (PaperCut).

CVSS VectorVendor: PaperCut

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 03, 2026 - 09:02 EUVD
Analysis Generated
Aug 03, 2026 - 08:22 vuln.today
CVE Published
Aug 03, 2026 - 06:58 cve.org
MEDIUM 6.9

DescriptionCVE.org

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.

AnalysisAI

PaperCut NG/MF's login component fails to enforce account lockout or rate-limiting controls in certain configurations, allowing unauthenticated remote attackers to conduct unrestricted brute-force or credential-stuffing attacks against user accounts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though the 'in some configurations' qualifier in the CVE description indicates exploitation is conditional on the absence of hardening controls. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify network-exposed PaperCut login endpoint
Delivery
Confirm no lockout via repeated failed attempts
Exploit
Automate credential-stuffing with known username/password pairs
Execution
Receive valid session on successful credential match
Impact
Access PaperCut NG/MF user or admin interface
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target PaperCut NG/MF instance is deployed without account lockout or rate-limiting controls enabled on the login component - the CVE description explicitly states the vulnerability applies 'in some configurations,' meaning instances with these protections active are not affected by this specific weakness. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 reflects moderate risk driven by the network-accessible, no-authentication, no-interaction attack profile, offset by limited confidentiality impact (VC:L) and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker identifies a PaperCut NG/MF instance exposed over the network, then confirms through repeated failed login attempts that no lockout or throttling mechanism activates. Using a credential-stuffing tool loaded with previously leaked username and password datasets, the attacker submits thousands of automated authentication requests to the login endpoint until a valid credential pair is matched, granting authenticated access to the PaperCut interface and potentially exposing user account data, print job histories, and administrative controls. …
Remediation Consult the PaperCut security bulletin at https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/ for the vendor's recommended fix; an exact patched version has not been confirmed from available intelligence data, so the bulletin must be treated as the authoritative source on patch availability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Papercut Ng Mf

View all
CVE-2026-8794 MEDIUM
6.9 Aug 03

Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component
CVE-2026-6418 MEDIUM
4.6 May 05

PaperCut MF version 25.0.4 allows authenticated administrators to read arbitrary files on the server through insufficien
CVE-2026-5115 LOW
3.6 Mar 31

PaperCut NG/MF embedded application on Konica Minolta multifunction devices transmits sensitive session data over an ins
CVE-2026-4794 LOW
2.1 Mar 31

Stored cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF versions before 25.0.10 allow authenticated administ

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all
CVE-2022-33106 CRITICAL POC
9.8
CVE-2026-44596 CRITICAL POC
9.8
CVE-2024-43042 CRITICAL POC
9.8
CVE-2024-39225 CRITICAL POC
9.8
CVE-2024-24767 CRITICAL POC
9.8
CVE-2023-6272 CRITICAL POC
9.8
CVE-2023-6756 CRITICAL POC
9.8
CVE-2023-49443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-52224 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy