All vulnerabilities
CVE-2026-14780

PaperCut NG/MF: Remote Code Execution via Scripting Subsystem

PaperCut PaperCut NG/MF
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.1.11Also 25.0.12, 26.0.2CVE List
Published24 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.

A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

Text from CVE List

Affected versions 3

  • PaperCut NG/MFaffected: all versions before 24.1.11CVE List
  • PaperCut NG/MFaffected: 25.0.0 before 25.0.12CVE List
  • PaperCut NG/MFaffected: 26.0.0 before 26.0.2CVE List

References 1