An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.
CVE-2026-87739 is an improper authentication vulnerability in PaperCut NG/MF that allows unauthenticated remote attackers to generate reports without valid credentials. This results in unauthorized access to sensitive information contained in those reports. The vulnerability affects multiple versions of PaperCut NG/MF prior to specific fixed releases.
CVE-2026-82077 is a path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF. It allows an authenticated administrator to execute arbitrary commands on the underlying host by using crafted fax provider settings. The vulnerability affects multiple version ranges of PaperCut NG/MF. The CVSS 4.0 score is 7.3, indicating a high severity issue.
CVE-2026-14780 is a high-severity vulnerability in the PaperCut NG/MF platform affecting its device-scripting functionality. It arises from insufficient sanitization and access controls in the embedded execution engine, allowing an authenticated administrator to supply malicious scripts that escape the runtime sandbox. Successful exploitation permits execution of unauthorized operating system commands with administrative privileges on the host system.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
CVE-2026-8794 is a timing discrepancy vulnerability in the authentication component of PaperCut NG/MF. An unauthenticated remote attacker can exploit this issue to enumerate valid usernames by measuring response times during login attempts. The vulnerability arises because the system only performs a password hash comparison when a valid account is supplied, creating a timing oracle. This flaw can reveal account existence without authentication.
CVE-2026-8793 is a vulnerability in PaperCut NG/MF where the software does not properly restrict excessive authentication attempts. This allows unauthenticated remote attackers to perform unlimited brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting in some configurations. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.
An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference.
Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.
An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files.
An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware.
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization.
Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files.
When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes.
This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.
CVE-2023-27351 is an improper authentication vulnerability in PaperCut NG/MF that allows remote attackers to bypass authentication via the SecurityRequestFilter class. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.
CVE-2026-5115 is a vulnerability in the PaperCut NG/MF embedded application for Konica Minolta devices that allows cleartext transmission of sensitive information. This insecure communication channel between the embedded application and the server could lead to session hijacking. An attacker exploiting this vulnerability might steal data or conduct phishing attacks on end users. The vulnerability has a low severity score of 3.6 and no known exploits in the wild. No patch or official remediation information is currently available.
CVE-2026-4794 is a low-severity cross-site scripting (XSS) vulnerability in PaperCut NG/MF versions before 25.0.10. It allows authenticated administrator users to inject arbitrary web script or HTML code via various UI fields. Exploitation requires an active administrator login session and could lead to compromise of other administrators' sessions or unauthorized actions within the administrator's context. No patch or official fix information is provided in the available data.
PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not fully configure the system to leverage the trust database on the clients, it opens up the communication between clients and the server to man-in-the-middle attacks.
It was discovered that certain parts of the documentation related to the configuration of SSL in Print Deploy were lacking, which could potentially contribute to a misconfiguration of the Print Deploy client installation. PaperCut strongly recommends to use valid certificates to secure installations and to follow the updated documentation to ensure the correct SSL configuration. Those who use private CAs and/or self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of their operating system and to the Java key store
CVE-2023-2533 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF version 22.0.10. It allows an attacker to trick an authenticated administrator into executing unauthorized actions by clicking a malicious link, potentially leading to changes in security settings or arbitrary code execution. Exploitation requires the admin to be logged in and interact with the malicious content. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 8.4. No known exploits are currently in the wild. European organizations using PaperCut NG/MF, especially in sectors with high administrative privileges, should prioritize patching and implement strict access controls to mitigate risk. Countries with significant PaperCut deployments and critical infrastructure are at higher risk.
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
