CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical

Detection and triage

Use read-only checks to decide whether CVE-2026-81578 reaches an owned asset. Treat advisories and proof-of-concept material as evidence, never as executable instructions.

AI evidence status: This source-linked enrichment passed the recipe-ready evidence gate. Verify its claims against the linked sources.

Business risk

Critical, actively exploited missing-authentication issue in PaperCut NG/MF that lets an unauthenticated remote attacker change system configuration through the web management interface. CISA lists it in KEV and notes it can be chained with CVE-2026-82078. PaperCut reports confirmed customer incidents and continued targeting of publicly reachable unpatched Application Servers.

Source-specific exposure conditions

• PaperCut NG or PaperCut MF Application Server with the web management interface reachable by untrusted networks, especially the public internet.
• Unauthenticated remote requests to administrative web-management functions can, under vendor-described conditions, run backend actions before access checks complete.
• Site Servers and secondary/print servers also need the patched build; Mobility Print and Print Deploy server components are not affected.
• PaperCut Hive and PaperCut Pocket are not in scope.

Detection signals and verification

• Fail-open behavior during identity-provider, cache, or network failure.
• Alternate protocol handlers, case normalization, duplicate headers, recovery links, and pre-authentication APIs.
• Authentication being present without equivalent authorization for the requested action.

• Confirm the Application Server reports a maintenance-release version of 24.1.10, 25.0.13, 26.0.5, or a later release in those supported lines; emergency patches reuse the unpatched version number and cannot be distinguished by version string alone.
• Confirm Site Servers and secondary/print servers also show a patched maintenance-release version.
• If verifying downloaded installers, compare SHA256 values with those published in the PaperCut security bulletin for the matching product, version, and platform.
• Confirm PaperCut Application Server web interfaces cannot be reached from untrusted internet addresses.
• After installing a maintenance release, confirm the in-product security notice has cleared.
• Review the vendor advisory investigation guidance and listed indicators of compromise; the vendor states absence of those indicators does not prove the system was not affected.

Stop and triage

• The NVD detail page could not be retrieved as HTML in this session; CNA/vendor/CISA sources were used instead.
• CNA affected ranges are 0 before 24.1.10, 25.0.0 before 25.0.13, and 26.0.0 before 26.0.5, while some CPE aggregations use earlier emergency-patch cutoffs (24.1.9, 25.0.12, 26.0.4). Treat 24.1.10, 25.0.13, and 26.0.5 as the vendor/CNA fixed maintenance versions.
• Emergency Patch Release 3 mitigates the issue but reports the same version number as the unpatched base build.
• PaperCut describes the bypass as occurring under specific conditions and does not publish those request conditions in the advisory.
• Later builds such as 24.1.11 exist after the CVE-fixing maintenance release and are not required to establish the fixed-version claim.

• Stop if any protected path lacks an explicit, testable authentication decision.
• Switch to incident response if unauthorized sessions or unexplained administrative access are identified.
• Do not validate using credentials or accounts not authorized for the test.

Triage output: Return a reviewer-ready minimal patch with exposure evidence, authoritative fixed-version evidence, regression tests, deployed-artifact verification, rollback notes, and source links; otherwise return TRIAGE.md with the blocking decision and owner.

Evidence-linked AI claims

• Affected Product: CVE-2026-81578 affects PaperCut NG and PaperCut MF; the vendor advisory applies to all versions of those products and does not apply to PaperCut Hive or PaperCut Pocket. Evidence
• Exposure: An improper access control issue in the web management interface allows unauthenticated remote requests targeting administrative functions to trigger backend actions before access validation completes, enabling modification of certain system configurations. Evidence
• Exposure: If the PaperCut NG/MF Application Server is accessible from the public internet, web access should be restricted to trusted IP addresses so web interfaces cannot be reached from untrusted internet addresses. Evidence
• Fixed Version: PaperCut NG/MF maintenance releases 24.1.10, 25.0.13, and 26.0.5 contain the security fixes for the CVEs in this advisory and replace the emergency patches. Evidence
• Remediation: Upgrade using the standard PaperCut upgrade procedure; also update Site Servers and secondary/print servers. Version 23 and earlier have no patched build and must move to a supported 24, 25, or 26 patched release while keeping web-access restriction in place. Evidence
• Verification: Maintenance releases carry new version numbers and published SHA256 checksums; emergency patches reuse the unpatched version number, so the in-product security notice may remain until a maintenance release is installed. Vendor post-install checks cover Site Servers and Card/ID lookup configuration. Evidence