PaperCut MF/NG EUVD-2026-67713

Network reachability to the PaperCut web management interface (default TCP 9191/9192) is required. No authentication is required (CVSS PR:N). The description states exploitation occurs 'under specific conditions,' and while CVSS rates AC:L and AT:N (suggesting conditions are not complex or rare), the exact triggering condition - such as a specific request path, HTTP method, or timing window - is not disclosed in available data; consult the vendor advisory for details. What limits exploitation in practice: organizations that restrict management interface access to internal or dedicated administrator subnets via firewall rules are substantially protected regardless of patch status. Direct internet exposure of the management interface represents the highest-risk deployment posture. No specific operating system, database backend, or non-default configuration flag is identified as a prerequisite beyond network reachability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) presents the most alarming possible network profile: remotely reachable, low complexity, no attack prerequisites, no authentication, no user interaction. The high integrity impact (VI:H) reflects the ability to modify system configurations - in a print management platform this could include altering user privilege mappings, redirecting print queues, or weakening security policies that enable further access. Confidentiality (VC:L) and availability (VA:L) impacts are limited, consistent with a configuration-modification flaw rather than full remote code execution. The phrase 'under specific conditions' in the vendor description introduces meaningful ambiguity: the CVSS AC:L and AT:N ratings suggest those conditions are not difficult to satisfy, but defenders should verify whether their specific deployment topology or configuration version falls within the exploitable window. No EPSS probability is available in the provided data, and the vulnerability is not listed in CISA KEV, which tempers urgency compared to CVE-2023-27350 (which reached KEV within days of disclosure). However, PaperCut's prior exploitation history by ransomware operators means threat actor familiarity with this attack surface is high, and the unauthenticated network vector means any internet-exposed management interface is immediately at risk. Organizations with the management interface restricted to internal networks retain significant protection.

An unauthenticated attacker who can reach TCP port 9191 or 9192 on the PaperCut application server sends a crafted HTTP request targeting an administrative endpoint. Due to the pre-validation execution flaw, the backend processes the configuration change before the access control check completes and rejects the request. The attacker successfully modifies a system setting - such as altering an administrative user's access level or changing a security policy - without ever presenting credentials, potentially enabling follow-on authenticated access or operational disruption.