PaperCut NG/MF EUVD-2026-52224

Exploitation requires that the target PaperCut NG/MF instance is deployed without account lockout or rate-limiting controls enabled on the login component - the CVE description explicitly states the vulnerability applies 'in some configurations,' meaning instances with these protections active are not affected by this specific weakness. Network-level access to the PaperCut web login interface is required (AV:N per CVSS 4.0). No authentication (PR:N), user interaction (UI:N), or special attack prerequisites (AT:N per vendor CVSS 4.0) are required against susceptible configurations. The primary limiting factor for defenders is verifying whether their specific PaperCut deployment has lockout or rate-limiting explicitly enabled in the admin configuration; environments where these controls are active fall outside the vulnerable condition. Direct impact is bounded to credential enumeration (VC:L) - this flaw does not itself cause data destruction or service disruption.

The CVSS 4.0 score of 6.9 reflects moderate risk driven by the network-accessible, no-authentication, no-interaction attack profile, offset by limited confidentiality impact (VC:L) and no integrity or availability impact. The 'in some configurations' condition is a critical real-world risk modifier: deployments with lockout or rate-limiting already enabled are not exploitable via this vector, which meaningfully reduces the exposed population beyond what the raw score implies. No EPSS data was provided in available intelligence; given the absence of a KEV listing and no confirmed POC, this is not under known mass exploitation at time of analysis. However, PaperCut has historically been a high-priority target - prior critical vulnerabilities such as CVE-2023-27350 were rapidly weaponized following disclosure - meaning this product's exposure surface warrants prompt remediation even at moderate severity. The vendor's inclusion of SC:L in the CVSS 4.0 vector suggests potential subsequent-system confidentiality impact, likely reflecting credential reuse risk; this is inferred rather than explicitly described in the CVE text.

An unauthenticated attacker identifies a PaperCut NG/MF instance exposed over the network, then confirms through repeated failed login attempts that no lockout or throttling mechanism activates. Using a credential-stuffing tool loaded with previously leaked username and password datasets, the attacker submits thousands of automated authentication requests to the login endpoint until a valid credential pair is matched, granting authenticated access to the PaperCut interface and potentially exposing user account data, print job histories, and administrative controls. No public exploit code has been identified at time of analysis.