# CVE-2026-81578: PaperCut NG/MF missing authentication for critical function

Source: https://junglewise.ai/threats/cve-2026-81578-papercut-ng-mf-missing-authentication-for-critical-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-81578 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-08-28

PaperCut NG/MF is a print and document management system widely used in organizations to control, monitor, and bill print jobs. This vulnerability allows attackers on the network to bypass authentication and modify critical system settings without needing valid credentials, potentially leading to unauthorized system control or service disruption. The vulnerability is actively being exploited in real-world attacks.

Technologies: [PaperCut Mf](https://junglewise.ai/threats/technologies/mf), [PaperCut Ng](https://junglewise.ai/threats/technologies/ng). Vendors: [PaperCut](https://junglewise.ai/threats/vendors/papercut).

## Quick answers

**Is CVE-2026-81578 exploited in the wild?** Yes. CVE-2026-81578 is known to be exploited in the wild, first recorded on 31 August 2026. Treat it as urgent.

**How severe is CVE-2026-81578?** Critical severity, with a CVSS score of 9.8, published 28 August 2026.

**Which products and versions are affected?** Papercut Mf <UNKNOWN>; Papercut Ng <UNKNOWN>.

**Is there a fix for CVE-2026-81578?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81578 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-81578?** Check whether you run PaperCut Mf, PaperCut Ng, Papercut Mf or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability in PaperCut NG/MF affecting a critical system function. The vulnerability allows unauthenticated remote attackers to access and modify system configurations that should require valid credentials. The attack vector is network-based with no authentication required from the attacker. The vulnerability has been observed being exploited in the wild and can be chained with CVE-2026-82078 to achieve greater impact on affected systems. Patch availability and detailed remediation guidance should be obtained from PaperCut's official security advisory.

## Affected products

- PaperCut PaperCut NG <UNKNOWN>
- PaperCut PaperCut MF <UNKNOWN>

## Timeline

- 2026-08-31: disclosed
- exploited: Exploited in the wild

## Related threats

- [PaperCut MF/NG authentication bypass in report generation](https://junglewise.ai/threats/cve-2026-87739-an-improper-authentication-vulnerability-in-papercut-mf-ng-allows)
- [PaperCut NG/MF path traversal in Scan-to-Fax component](https://junglewise.ai/threats/cve-2026-82077-an-improper-limitation-of-a-pathname-to-a-restricted-directory)
- [PaperCut NG/MF sandbox escape in device scripting](https://junglewise.ai/threats/cve-2026-14780-a-vulnerability-exists-in-the-papercut-ng-mf-platform-s-device)
- [PaperCut NG/MF unsafe reflection vulnerability](https://junglewise.ai/threats/cve-2026-82078-papercut-ng-mf-unsafe-reflection-vulnerability)
- [PaperCut MF and NG path traversal in Shared Account Synchronization](https://junglewise.ai/threats/cve-2026-6418-papercut-mf-and-ng-path-traversal-in-shared-account)