# CVE-2026-14780: PaperCut NG/MF sandbox escape in device scripting

Source: https://junglewise.ai/threats/cve-2026-14780-a-vulnerability-exists-in-the-papercut-ng-mf-platform-s-device  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-14780 · Severity: info · Published 2026-09-24

PaperCut NG/MF is a print management server that controls printing across organizations. An authenticated administrator can upload a malicious script to the device scripting functionality that breaks out of the execution sandbox and runs arbitrary operating system commands with full administrative privileges on the server, compromising the entire infrastructure.

Technologies: [PaperCut Mf](https://junglewise.ai/threats/technologies/mf), [PaperCut Ng](https://junglewise.ai/threats/technologies/ng). Vendors: [PaperCut](https://junglewise.ai/threats/vendors/papercut).

## Quick answers

**Is CVE-2026-14780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14780 being exploited in the wild.

**How severe is CVE-2026-14780?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** PaperCut NG; PaperCut MF.

**Is there a fix for CVE-2026-14780?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14780 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14780?** Check whether you run PaperCut Mf or PaperCut Ng. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the device-scripting engine due to insufficient input sanitization and access controls that allow an authenticated administrator to escape the runtime sandbox. An attacker with administrative credentials can execute arbitrary OS commands with full system privileges on the host operating system through malicious script injection.

## Affected products

- PaperCut NG
- PaperCut MF

## Timeline

- 2026-09-24: disclosed

## References

- [https://www.papercut.com/kb/Main/security-bulletin-sep-2026/](https://www.papercut.com/kb/Main/security-bulletin-sep-2026/)

## Related threats

- [PaperCut MF/NG authentication bypass in report generation](https://junglewise.ai/threats/cve-2026-87739-an-improper-authentication-vulnerability-in-papercut-mf-ng-allows)
- [PaperCut NG/MF path traversal in Scan-to-Fax component](https://junglewise.ai/threats/cve-2026-82077-an-improper-limitation-of-a-pathname-to-a-restricted-directory)
- [PaperCut NG/MF unsafe reflection vulnerability](https://junglewise.ai/threats/cve-2026-82078-papercut-ng-mf-unsafe-reflection-vulnerability)
- [PaperCut NG/MF missing authentication for critical function](https://junglewise.ai/threats/cve-2026-81578-papercut-ng-mf-missing-authentication-for-critical-function)
- [PaperCut NG/MF authentication bypass in SecurityRequestFilter](https://junglewise.ai/threats/cve-2023-27351-papercut-ng-mf-authentication-bypass-in-securityrequestfilter)