papercut has 7 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 4. The median CVSS is 7.5 (high), with 2 rated critical. 43% have been exploited in the wild — well above the 1% corpus average, so papercut flaws are worth patching on sight. When CISA adds a papercut CVE to KEV it happens fast: a median of 3 days after publication (3 cases). Most affected products: PaperCut NG/MF (3), papercut_mf (2), PaperCut Hive (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 43% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- 3 d median(3)
- Last 90 days
- 6 prev 0
Products
- PaperCut NG/MF 3
- papercut_mf 2
- PaperCut Hive 1
- PaperCut MF/NG 1
Worst active — by depth score
CVE-2026-81578Critical· 9.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG96CVE-2026-82078Critical· 9.4PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector89CVE-2023-27351High· 7.5This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914)87CVE-2026-14780High· 7.5A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine41CVE-2026-82077High· 7.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlyi…40
papercut vulnerabilities
CVEs affecting papercut, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-87739Medium· 6.9An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and …
CVE-2026-82077High· 7.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlyi…
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlyi…
CVE-2026-11744Low· 3.8An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's we…
CVE-2026-14780High· 7.5A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the…
CVE-2026-81578Critical· 9.8CISA KEVPoCAn improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions pri…
CVE-2026-82078Critical· 9.4CISA KEVPoCPaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against …
CVE-2023-27351High· 7.5CISA KEV0dayPoCThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914)
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the Security…