All vulnerabilities
CVE-2026-82077

PaperCut NG/MF: Remote Code Execution via Scan2Fax

PaperCut PaperCut NG/MF
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.74%Chance of exploitation activity in the next 30 days, higher than 54% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.1.10Also 25.0.13, 26.0.5CVE List
Published24 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 24 Sep 2026, 06:43 UTCPublishedCVE List
  2. 9 Oct 2026, 17:31 UTCFirst reported exploitedwatchTowr Labs
  3. NowNot on CISA's known exploited list yet

Description

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

Text from CVE List

Affected versions 3

  • PaperCut NG/MFaffected: all versions before 24.1.10CVE List
  • PaperCut NG/MFaffected: 25.0.0 before 25.0.13CVE List
  • PaperCut NG/MFaffected: 26.0.0 before 26.0.5CVE List

References 1