CVE-2026-87739 PaperCut CVE debrief

Who should care

PaperCut NG/MF administrators and security teams should be aware of this vulnerability and take necessary actions to prevent exploitation. They should verify their version, restrict report access, and monitor activity to mitigate potential impacts. Additionally, operators and platform administrators should review the vulnerability details and implement necessary mitigations to prevent unauthorized access to sensitive information.

Why it matters

CVE-2026-87739 is a medium-severity vulnerability in PaperCut MF/NG that allows unauthenticated report generation, potentially exposing sensitive information. Administrators should verify their version, restrict report access, and monitor activity.

• Potential exposure of sensitive information through report generation
• Need for verification of current version and exposure
• Possible impact on confidentiality

Technical summary

CVE-2026-87739 is an improper authentication vulnerability in PaperCut MF/NG that allows unauthenticated, remote attackers to generate reports, potentially exposing sensitive information. This vulnerability can be exploited by submitting report generation requests without valid credentials. Affected versions require immediate attention to prevent unauthorized access to sensitive information. Administrators should verify their version, restrict report access, and monitor activity to mitigate potential impacts. The vulnerability has a medium severity score and can lead to unauthorized access to sensitive information through report generation.

Defensive priority

Medium priority for PaperCut NG/MF administrators

Recommended defensive actions

• Review and update PaperCut NG/MF to the latest version
• Restrict report generation access to authenticated users
• Monitor for suspicious report generation activity
• Verify current version and exposure
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. PaperCut's security bulletin offers additional details. The vulnerability has been publicly disclosed, and affected versions require immediate attention. Administrators should verify their version, restrict report access, and monitor activity to mitigate potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.