Papercut

Known Exploited Papercut Vulnerabilities

The following Papercut vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. The vulnerability CVE-2023-2533: PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability is in the top 5% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 13 vulnerabilities in Papercut with an average score of 7.3 out of ten. Papercut did not have any published security vulnerabilities last year. That is, 13 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Papercut Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-11744	Sep 24, 2026	PaperCut Hive NFC Input Validation Flaw allows Local Code Execution An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.
CVE-2026-87739	Sep 24, 2026	PaperCut MF/NG Improper Auth Allows Unauth Report Generation An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.	Papercut Ng
CVE-2026-82077	Sep 24, 2026	PaperCut NG/ MF Path Traversal allows Auth Admin Remote Command Execution An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.	Papercut Ng
CVE-2026-14780	Sep 24, 2026	PaperCut NG/MF Device-Scripting Engine Bypass Enables OS Command Execution A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.	Papercut Ng
CVE-2026-82078	Aug 28, 2026	PaperCut MF/NG Dynamic Class Loading Vulnerability (CVE-2026-82078) An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.	Papercut Mf
CVE-2026-81578	Aug 28, 2026	PaperCut MF/NG Improper Access Control in Web Management Interface An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.	Papercut Mf
CVE-2026-8793	Aug 03, 2026	PaperCut NG/MF <=26.0.2 Login Brute-Force without Lockout PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.	Papercut Ng
CVE-2026-6645	Jun 22, 2026	PaperCut Print Deploy Client exe Process Execution Vulnerability (CVE-2026-6645) An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference. Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.
CVE-2026-7824	May 05, 2026	PaperCut Hive: Plain Text Admin Credentials Logged via Deep Logging An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files. An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware.
CVE-2026-6418	May 05, 2026	PaperCut MF 25.0.4 Shared Account Sync Arbitrary File Path Disclosure An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.	Papercut Ng