CVE-2026-6180: PaperCut MF race condition in HP badge-swipe processing

CVE-2026-6180 · Severity: high · CVSS 8.1 · Published 2026-05-05

A security vulnerability exists in PaperCut MF and NG print management software when used with certain HP multifunction printers. Under specific network conditions, the system may incorrectly process badge-swipe data, leading to a truncated user ID. In environments using custom ID processing scripts, this can allow an attacker to be logged in as a different user, potentially gaining unauthorized access to sensitive documents or administrative functions on the printing device.

Technologies: Papercut Mf, Papercut Ng. Vendors: PaperCut.

Quick answers

Is CVE-2026-6180 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6180 being exploited in the wild.
How severe is CVE-2026-6180?
High severity, with a CVSS score of 8.1, published 5 May 2026.
Which products and versions are affected?
Papercut Mf up to (excluding) 24.1.9, from (including) 25.0.2 up to (excluding) 25.0.10; Papercut Ng up to (excluding) 24.1.9, from (including) 25.0.2 up to (excluding) 25.0.10.
Is there a fix for CVE-2026-6180?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6180 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6180?
Check whether you run Papercut Mf or Papercut Ng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-367) exists in the way PaperCut MF and NG process fragmented badge-swipe data from specific HP multifunction devices. When network conditions involve dropped packets and out-of-order sequence counters, the server may fail to receive a sequence reset notification, causing it to reject initial data chunks while erroneously accepting subsequent ones. This results in the registration of a truncated badge ID string. If the environment uses custom badge-ID post-processing scripts, this truncated string can be transformed into a valid ID for a different user, leading to an 'Incorrect User Login' and unauthorized session establishment. The vulnerability is reachable over the network but requires specific timing and network conditions (High Attack Complexity). Fixed versions include 24.1.9 and 25.0.10.

Affected products

  • PaperCut PaperCut MF up to (excluding) 24.1.9, from (including) 25.0.2 up to (excluding) 25.0.10
  • PaperCut PaperCut NG up to (excluding) 24.1.9, from (including) 25.0.2 up to (excluding) 25.0.10

Timeline

  • 2026-05-05: advisory: Initial advisory published by PaperCut
  • 2026-05-12: other: NIST initial analysis and CVSS scoring completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.