As cited
Copy frozen at (site build).
vulnerabilities
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
PaperCut, print management software used widely by schools, hospitals, and government agencies, contained multiple pre-authentication remote code execution (RCE) vulnerabilities that were exploited in the wild. Security researchers discovered that initial patches introduced bypass vulnerabilities, requiring multiple rounds of updates: a chain combining authentication bypass (WT-2026-0143) with a new post-auth RCE in the scan-to-fax functionality (CVE-2026-82077) enabled unauthenticated system compromise on patched versions through October 10, 2026.
Why it matters: Organizations running PaperCut NG 26.0.3 through 26.0.4-PO build 76508 are at risk of complete system compromise via unauthenticated RCE; immediate upgrade to version 26.0.5 or later is required.
- Source published
- First seen by Cybersecurity Tracker