CVE-2026-81578

An unauthenticated remote attacker can modify critical system configurations in PaperCut NG/MF, which can be chained with another vulnerability to escalate privileges.

PaperCut NG/MF lacks authentication for critical functions, allowing remote attackers to alter system settings without credentials. This is a severe compliance failure for DIBs because it bypasses access controls, enabling lateral movement and data exfiltration. Organizations must patch immediately and restrict network access to PaperCut services.

Shame score — A missing authentication for critical functions is a fundamental design flaw that allows unauthenticated remote modification of system configurations, representing a severe avoidable security failure.