Critical severity9.8CISA KEVNVD Advisory· Published Aug 28, 2026· Updated Sep 14, 2026
CVE-2026-81578
CVE-2026-81578
Description
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
3- github.com/rapid7/metasploit-framework/pull/21842nvdIssue TrackingPatch
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdPatchThird Party AdvisoryUS Government Resource
- www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/nvdPatchVendor Advisory
News mentions
25- Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)watchTowr Labs · Oct 9, 2026
- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- Hackers Turned a PaperCut Print Server Into a Path to the Domain ControllerCyber Security News · Sep 30, 2026
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsThe Hacker News · Sep 14, 2026
- Metasploit Wrap Up: This One Goes to Sixteen!Rapid7 Blog · Sep 11, 2026
- AI agents exploited PaperCut flaws to breach 395 organizationsHelp Net Security · Sep 11, 2026
- PaperCut Flaws Exploited in AI-Powered AttacksSecurityWeek · Sep 11, 2026
- PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited FlawsThe Hacker News · Sep 11, 2026
- Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off scriptThe Register Security · Sep 10, 2026
- PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ InstancesThe Hacker News · Sep 10, 2026
- Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers WorldwideCyber Security News · Sep 9, 2026
- Hackers Actively Exploiting PaperCut Servers Command Execution VulnerabilitiesCyber Security News · Sep 7, 2026
- Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and UniversitiesThe Hacker News · Sep 5, 2026
- PaperCut Exploitation Escalates to Active IntrusionsSecurityWeek · Sep 1, 2026
- Attackers Actively Exploit Flaws in PaperCut NG/MFGovInfoSecurity · Aug 31, 2026
- CISA Warns of Multiple PaperCut NG/MF Vulnerabilities Actively Exploited in AttacksCyber Security News · Aug 31, 2026
- Attackers plant remote access tools on compromised PaperCut serversHelp Net Security · Aug 31, 2026
- ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and MoreThe Hacker News · Aug 31, 2026
- 31st August – Threat Intelligence ReportCheck Point Research · Aug 31, 2026
- More Details Emerge on Exploited PaperCut VulnerabilitiesSecurityWeek · Aug 31, 2026
- Papercut: 2 Actively-Exploited Flaws Added to CISA KEVVypr Intelligence · Aug 31, 2026
- Attackers Chain Two PaperCut Flaws to Execute Code Without AuthenticationThe Hacker News · Aug 28, 2026
- PaperCut warns of hackers using printer management software flaw in attacksThe Record · Aug 28, 2026
- PaperCut NG/MF Critical Zero-Day Exploited in the WildRapid7 Blog · Aug 28, 2026
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts