CVE-2026-81578: high-severity vulnerability (CVSS 8.8) in PaperCut NG/MF, actively exploited

CVE-2026-81578: high-severity vulnerability (CVSS 8.8) in PaperCut NG/MF, actively exploited

In short

PaperCut, a manufacturer of print management software, has a vulnerability identified as CVE-2026-81578 in its PaperCut NG and PaperCut MF products [1]. The flaw allows an attacker with no credentials whatsoever to modify system configurations through the web-based administration interface [1]. NVD classifies it with "high" severity and a CVSS score of 8.8 out of 10 [1], and the vulnerability appears in the Known Exploited Vulnerabilities (KEV) catalog of the US cybersecurity agency CISA [2]. If your organization uses PaperCut NG or MF, today's recommendation is simple: check whether you have instances exposed to the internet and apply the manufacturer's security update as soon as possible.

What it is and why it matters

According to the official description of the flaw, this is an issue of improper access control in the web management interface of PaperCut NG and MF [1]. Under certain conditions, a remote, unauthenticated request directed at administrative functions can execute actions on the server before the corresponding access validation is completed [1]. In practice, this means that someone outside the organization, without a username or password, could manage to modify critical print system configurations [1].

NVD rates this vulnerability as high severity, with a CVSS score of 8.8 [1]. In addition, it is included in CISA's KEV catalog, which lists vulnerabilities with evidence of active exploitation in the real world [2]. OCIRIA's threat radar, for its part, internally raises the risk level to critical for business prioritization purposes, precisely because of that confirmed active exploitation and because of the possibility of chaining this flaw with another related vulnerability to expand its impact. It is important to distinguish between the two: the "high" rating comes from NVD [1]; the "critical" rating is an internal OCIRIA prioritization assessment, not an official label from the CVE catalog.

Who is affected

This affects organizations that have deployed PaperCut NG or PaperCut MF, the two manufacturer products explicitly mentioned in the advisory [1]. No specific versions are stated in the verified data we have available, so the general recommendation is to check with the vendor or your IT team which version is installed and whether it is among those affected.

How to know if you are vulnerable

The first step is to confirm whether PaperCut NG or MF is part of your infrastructure and, if so, whether the web administration interface is accessible from outside the corporate network. Since the flaw allows unauthenticated actions through that interface [1], any instance directly exposed to the internet should be considered high risk until patching is confirmed.

A quick, practical step is to review your actual exposure surface: which services and ports in your organization are visible from the internet, and whether a publicly accessible PaperCut management interface appears among them. Many organizations discover exposures of this kind that were not on their radar because they were deployed a long time ago and no one has reviewed them since.

How to protect yourself

• Identify all PaperCut NG and MF installations in your organization, including those managed by third parties or subsidiaries.
• Contact the manufacturer or your support provider to apply the corresponding security patch or update as soon as possible, given that the vulnerability is already listed as actively exploited according to CISA KEV [2].
• While the patch is being applied, restrict access to the web administration interface to internal or trusted networks only, avoiding direct exposure to the internet.
• Review the print system's logs and configurations for recent unauthorized changes, especially in administrative parameters.
• If you detect signs of unauthorized modification, treat the incident as a possible compromise and activate your response procedure.
• Keep in mind that, according to OCIRIA's radar, this flaw could be chained with another related vulnerability to expand its impact, so it is also worth reviewing other pending updates from the same manufacturer.

Frequently asked questions

Is this a critical or high vulnerability?

NVD officially classifies it as high severity, with CVSS 8.8 [1]. OCIRIA's internal radar marks it as critical for response prioritization purposes, due to confirmed active exploitation, but that is an internal business assessment, not NVD's official label.

Is it already being exploited?

Yes, the vulnerability appears in the CISA KEV catalog, which only includes flaws with evidence of active exploitation [2].

What do I need to do if I use PaperCut?

Confirm the installed version, limit public exposure of the administration interface, and apply the manufacturer's update as soon as it is available [1][2].

Does it only affect large companies?

The verified data does not distinguish by organization size; it affects any environment using PaperCut NG or MF with the administration interface accessible [1].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-81578
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json