PaperCut NG/MF EUVD-2026-85811

Requires an authenticated PaperCut administrator account (CVSS PR:H) with access to the Scan-to-Fax feature's fax-provider configuration; exploitation is performed by supplying crafted fax provider settings that contain path-traversal sequences. The Scan-to-Fax component must be present/enabled and the admin console must be reachable over the network (AV:N). The primary limiting factor is the high-privilege prerequisite - this is not exploitable by unauthenticated or low-privilege users directly, so realistic risk concentrates on internet-exposed admin interfaces, credential compromise, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.

This is a genuinely serious post-authentication flaw but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, base 7.3) shows network-reachable, low-complexity exploitation yielding full confidentiality, integrity and availability impact on the host - but the decisive limiter is PR:H: the attacker must already hold PaperCut administrator credentials. The vector's E:P (Proof-of-Concept) exploit-maturity metric signals that at least PoC-grade exploit knowledge exists, though no PoC URL is provided in the references, so treat this as an exploit-maturity claim rather than a confirmed public exploit. It is NOT in CISA KEV and no EPSS score is provided, so there is no evidence of active or widespread exploitation. Net: real priority for internet-exposed PaperCut admin consoles because the payoff is OS command execution (privilege escalation from application admin to host), but the high-privilege precondition means it is primarily a post-compromise or insider/lateral-movement escalation rather than a mass-exploitable pre-auth bug. Note this is a sibling issue to CVE-2026-14780 (device-scripting sandbox escape to admin RCE) in the same September-2026 PaperCut bulletin - chaining a lower-privilege bug into admin would remove the PR:H barrier.

An attacker who has obtained (or is issued) PaperCut administrator access - via stolen/default credentials, a phishing-compromised admin, or a chained privilege-escalation bug - navigates to the Scan-to-Fax fax-provider configuration and submits crafted fax provider settings containing traversal sequences that escape the intended directory and cause arbitrary OS commands to run on the print server. The CVSS exploit-maturity metric (E:P) indicates proof-of-concept-level exploit knowledge exists, though no public exploit is linked; the low attack complexity (AC:L) means no special timing or race is required once admin access is held.