Critical Actively exploited

CVE-2026-81578

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

What this means

Weakness: A sensitive function is reachable with no authentication at all.
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 14 September 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 31 August 2026
CVSS: —
EPSS: 0.77% probability of exploitation within 30 days · above 53% of all CVEs
Weakness: CWE-306
CISA due date: 14 September 2026
Sources: cisa-kev

Our analysis Two PaperCut zero-days chain into unauthenticated code execution and land on the KEV catalog

References

https://nvd.nist.gov/vuln/detail/CVE-2026-81578