CVE-2026-8793 describes a vulnerability in PaperCut NG/MF where the login mechanism fails to enforce restrictions on excessive authentication attempts. This flaw enables unauthenticated remote attackers to conduct brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting protections, depending on the configuration. The issue is categorized as CWE-307 and carries a CVSS 4.0 base score of 6.9 (medium severity). There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

An attacker can perform unlimited authentication attempts remotely without being blocked or rate-limited, increasing the risk of successful brute-force or credential-stuffing attacks. This could lead to unauthorized access if valid credentials are compromised. The vulnerability does not require user interaction or privileges and affects confidentiality and integrity to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing external mitigations such as network-level rate limiting, multi-factor authentication, or monitoring for suspicious login activity where possible. Avoid relying solely on the product's internal lockout mechanisms in affected configurations.