CVE-2026-81578 · Moderate · CISA KEV

PaperCut NG/MF Critical Function Vulnerability: Unauthenticated Remote Configuration Modification

Threat Engine Auto-Feed · data current as of 2026-08-31

CVE-2026-81578 in PaperCut NG/MF allows unauthenticated remote attackers to modify critical system configurations. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. While the EPSS is low, the confirmed in-the-wild exploitation indicates a significant immediate risk.

  • CVSS:
  • EPSS percentile: 0.32397
  • Exploitation pressure: 44/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 32th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is a 'missing authentication for critical function,' meaning a specific, important operation within the software does not properly check if the user attempting to perform it is authorized. An attacker can therefore execute this critical function without needing to log in or provide any credentials.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using PaperCut NG/MF for print management, especially those with critical system configurations managed by the software.
  • Financial services and Technology sectors, given the documented targeting by financially motivated and state-sponsored threat actors.

Misconfigurations that escalate it

  • Lack of network segmentation that would prevent unauthenticated remote access to PaperCut NG/MF instances.
  • Failure to promptly apply security updates for PaperCut NG/MF.

High-impact scenarios

  • An unauthenticated attacker can modify critical system configurations, potentially leading to denial of service, data manipulation, or further compromise when chained with other vulnerabilities.
  • Compromise of print management infrastructure, which could disrupt business operations and provide a pivot point into the broader network.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor PaperCut NG/MF system logs for unauthorized or unexpected configuration changes.
  • Implement network intrusion detection systems (NIDS) to identify unusual traffic patterns or exploit attempts targeting PaperCut NG/MF.

Contain

  • Isolate affected PaperCut NG/MF instances from the network if compromise is suspected.
  • Review and revert any unauthorized configuration changes to known good states.

Patch

  • Apply the latest security updates and patches provided by PaperCut for NG/MF immediately.
  • Regularly review and update PaperCut NG/MF configurations to align with security best practices.

Frontier verdict — Moderate

Prioritize immediate patching due to confirmed in-the-wild exploitation (CISA KEV) allowing unauthenticated remote critical configuration modification.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.