CRITICALCVSS 9.8Vulnerability

CVE-2026-81578

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

Properties

severity
CRITICAL
vulnerabilityName
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
product
NG/MF
cvss_severity
CRITICAL
cvss_score
9.8
epss_score
0.85581
dueDate
2026-09-14
retrieved_at
2026-10-14T08:32:14+00:00
requiredAction
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon
dateAdded
2026-08-31
last_source
FIRST EPSS
score
9.8
cve_id
CVE-2026-81578
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
signal_observed_at
2026-09-11T17:54:47+00:00
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendorProject
PaperCut
published_at
2026-08-28T16:18:29.600
last_modified
2026-09-14T00:16:56.207
epss_percentile
0.99721

Related Entities (12)

MENTIONED_IN (4)

→[Campaign]PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578
→[Campaign]GhostCode: Dissecting a Novel Device Code Phishing Kit
→[Campaign]Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale
→[Campaign]Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

INVOLVES (1)

←[Signal]

AFFECTS_PRODUCT (2)

→[Product]
→[Product]

HAS_WEAKNESS (1)

→[Weakness]Authentication Bypass by Primary Weakness

DESCRIBED_BY (1)

→[Source]NVD

ENRICHED_BY (1)

→[Source]FIRST EPSS

KNOWN_EXPLOITED (1)

→[Source]CISA KEV

DESCRIBES (1)

←[KEVEntry]PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop