PaperCut NG/MF Authentication Bypass
Authentication bypass in PaperCut NG/MF (CVSS 9.8, Critical) lets unauthenticated attackers access admin functions via malformed requests. Actively exploited; apply Emergency Patch Release 2.
- Vendor
- PaperCut Software
- Product
- PaperCut NG and PaperCut MF (versions 24, 25, 26)
- CVSS
- 9.8
- EPSS (exploit probability)
- 85.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-81578 being exploited?
Yes. CISA added CVE-2026-81578 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 85.6% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-81578 timeline
- Added to EU KEV (ENISA)-1d (before NVD)
- Published to NVD
- First 0dayNews coverage+1d
- Added to CISA KEV+3d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-81578 is an authentication bypass in PaperCut NG and PaperCut MF affecting versions 24, 25, and 26. Unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes, allowing an attacker to bypass the login requirement entirely.
This flaw is the entry point for the two-CVE attack chain detailed in Rapid7’s analysis. Exploiting CVE-2026-81578 provides the unauthenticated access needed to weaponize the critical class-loading flaw in CVE-2026-82078.
Active exploitation was confirmed before the initial patch shipped. Researchers at Huntress and watchTowr identified bypass methods in PaperCut’s first emergency patch; Emergency Patch Release 2 addresses those gaps.
Patch: Apply Emergency Patch Release 2 for PaperCut NG/MF versions 24, 25, or 26. Version 23 and older users should upgrade to a supported release. Full guidance in PaperCut’s updated bulletin.
Other PaperCut Software CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-82078 PaperCut NG/MF Unsafe Class-Loading RCEwrite-up | [ CRITICAL ] | 9.1 | 63.5% |
