/Vulnerability Library

PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

CVE-2026-81578
Verified

Description

PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.

Severity

Critical

CVSS Score

9.8

Exploit Probability

86%

Affected Product

papercut_ng,papercut_mf

Published Date

August 28, 2026

Template Author

darses, dhiyaneshdk

CVE-2026-81578.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-81578
CWE ID:
cwe-306

References

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/https://nvd.nist.gov/vuln/detail/CVE-2026-81578https://nvd.nist.gov/vuln/detail/CVE-2026-82078

Remediation Steps

Update to PaperCut NG/MF version 26.0.5, 25.0.13, or 24.1.10 or later. As an immediate mitigation, restrict network access to the PaperCut web management interface (default ports 9191 and 9192) to trusted administrative IPs only.