CVE-2026-81578

criticalpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · ENISAEPSS 0.856 · 100 %ileexploit · weaponizedNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · weaponized

Likely / severe?

85.6% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

13 products

Check your exposure

Who says so?

3 sources

fstec_bdu · ncsc_nl · nvd

added 2026-08-31remediate by 2026-09-14

required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EU KEVflagged by ENISAreported 2026-08-27patched 2026-08-28

Authentication bypass in the web management interface.

EPSS · scored 2026-10-22

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.6–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.18.6highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Lsecondary · FSTEC (BDU) RU

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-305USCWE-305USCWE-306US

exploits (3)

Public proof-of-concept and weaponised exploit code.

affected products (13)

Products and version ranges known to be affected.

PaperCut Software International Pty Ltd PaperCut MF≤ 24.1.10fstec_bduRU
PaperCut Software International Pty Ltd PaperCut MF≤ 26.0.5fstec_bduRU
PaperCut Software International Pty Ltd PaperCut MF≤ 25.0.13fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ 24.1.10fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ 26.0.5fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ 25.0.13fstec_bduRU
PaperCut PaperCut≤ vers:unknown/*ncsc_nlNL
papercut papercut mf< 24.1.9nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut mf25.0.2 → 25.0.12nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut mf26.0.2 → 26.0.4nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut ng< 24.1.9nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
papercut papercut ng25.0.2 → 25.0.12nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
papercut papercut ng26.0.2 → 26.0.4nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0334Kwetsbaarheden verholpen in PaperCut MF en PaperCut NG van PaperCutNL2026-08-28csaf · ncsc_nlNL
PaperCut heeft kwetsbaarheden verholpen in PaperCut MF en PaperCut NG.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-15087 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu ncsc_nl nvd NVD CVE.org MITRE

published 2026-08-28modified 2026-09-25

references (3) nvd

External citations — patches, advisories, analysis.

https://github.com/rapid7/metasploit-framework/pull/21842Issue TrackingPatch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578PatchThird Party AdvisoryUS Government Resource
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/PatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan