4
CVEs
1
Critical
1
High
2
KEV
2
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82078 | Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable. | CRITICAL | 9.4 | 0.5% | 132 |
KEV
PoC
|
| CVE-2026-81578 | Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets. | HIGH | 8.8 | 0.4% | 129 |
KEV
PoC
|
| CVE-2026-8793 | PaperCut NG/MF's login component fails to enforce account lockout or rate-limiting controls in certain configurations, allowing unauthenticated remote attackers to conduct unrestricted brute-force or credential-stuffing attacks against user accounts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though the 'in some configurations' qualifier in the CVE description indicates exploitation is conditional on the absence of hardening controls. PaperCut published a security bulletin on August 3, 2026; no public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.9 | 0.7% | 35 |
|
| CVE-2026-8794 | Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component, exploitable by unauthenticated remote attackers. The system conditionally executes password hash comparison only when a submitted username corresponds to a valid account, producing a measurable latency difference that reveals account existence. No public exploit code or CISA KEV listing has been identified at time of analysis; however, with a CVSS 4.0 score of 6.9 and an AV:N/PR:N vector, the attack surface is entirely remote and requires no credentials, making it accessible to any attacker with network reach to the login endpoint. | MEDIUM | 6.9 | 0.7% | 35 |
|