Medium severity · published Sep 24, 2026
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report generation
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PN
PaperCut NG/MF · PaperCut
before 24.1.10; 25.0.0 before 25.0.13; 26.0.0 before 26.0.5 · source: vendor
Affected product
PN
PaperCut NG/MF
PaperCut
More from PaperCut NG/MF
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
8.1
CVE-2026-6180
PaperCut MF: Card truncation on HP readers
7.5
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
7.5
CVE-2026-5115
Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices
7.3
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax