CVE-2026-8793
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.
Risk Assessment
The risk is the potential compromise of user accounts through brute-force attacks, leading to unauthorized access to the system and data.
Recommendation
It is recommended to implement authentication attempt restrictions such as account lockout after a certain number of failed attempts and enable rate-limiting.
Other vulnerabilities in PaperCut NG/MF
See all- CVE-2026-14780High
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
- CVE-2026-8794Medium
PaperCut NG/MF has an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can enumerate usernames by measuring response times during login attempts.
Original NVD description (English source)
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.