PaperCut MF/NG vulnerabilities
3 known CVE vulnerabilities in PaperCut MF/NG, translated and rated.
- CVE-2026-87739Medium
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
- CVE-2026-82078CriticalActively exploited
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist. If an attacker can manipulate system configuration, this enables execution of arbitrary Java bytecode under the security context of the PaperCut server process.
- CVE-2026-81578CriticalActively exploited
Improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes, allowing modification of certain system configurations.