CVE-2026-87739
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
Risk Assessment
Unauthorized access to reports may expose sensitive data such as printing, billing, or user information.
Recommendation
Update PaperCut MF/NG to the latest version and restrict access to report generation functionality.
Other vulnerabilities in PaperCut MF/NG
See all- CVE-2026-82078CriticalActively exploited
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist. If an attacker can manipulate system configuration, this enables execution of arbitrary Java bytecode under the security context of the PaperCut server process.
- CVE-2026-81578CriticalActively exploited
Improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes, allowing modification of certain system configurations.
Original NVD description (English source)
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.