Medium severity · published Mar 31, 2026
CVE-2026-4794
Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
PaperCut MF/NG · PaperCut
before 25.0.10 · source: NVD
PN
PaperCut NG/MF · PaperCut
before 25.0.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4794
Vendor Advisory
https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-march-2026/
More from PaperCut MF/NG
9.8
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
9.8
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
9.1
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
7.5
CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability