CVE-2026-14780: PaperCut NG/MF RCE Vulnerability

CVE-2026-14780 Overview

CVE-2026-14780 is a code injection vulnerability in the PaperCut NG/MF platform's device-scripting functionality. The flaw stems from insufficient sanitization and access restrictions within the embedded script execution engine. An authenticated administrator can supply a malicious script that escapes the runtime sandbox and executes arbitrary operating system commands on the host. The weakness is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation grants an attacker administrative command execution on the PaperCut host operating system, exposing print infrastructure, stored credentials, and adjacent network services.

Affected Products

PaperCut NG (device-scripting component)
PaperCut MF (device-scripting component)
Deployments exposing the management interface to authenticated administrators

Discovery Timeline

2026-09-24 - CVE-2026-14780 published to NVD
2026-09-25 - Last updated in NVD database
September 2026 - PaperCut publishes the PaperCut Security Bulletin September 2026

Technical Details for CVE-2026-14780

Vulnerability Analysis

PaperCut NG/MF includes a device-scripting feature that allows administrators to define automation logic for printer behavior. The scripting runtime is intended to execute within a restricted sandbox that prevents direct interaction with the underlying operating system. CVE-2026-14780 breaks that boundary. The embedded execution engine does not adequately sanitize script input or enforce access restrictions on sensitive runtime objects. An authenticated administrator can craft a script that reaches outside the sandbox and invokes host-level operations.

The PaperCut service typically runs with elevated privileges, so commands triggered through the escape execute with administrative rights on the host. This provides a direct pivot from application-layer administration into full operating system control.

Root Cause

The root cause is improper control of code generation within the device-scripting engine [CWE-94]. The sandbox fails to restrict access to privileged runtime primitives, and script input is not filtered to prevent references to those primitives. The combination allows an attacker-controlled script to transition from sandboxed scripting context to arbitrary host command execution.

Attack Vector

Exploitation requires network access to the PaperCut management interface and valid administrative credentials. The attack vector is network-based with high privilege requirements and no user interaction. An attacker who has compromised an administrator account, or an insider with administrative access, uploads or edits a device script containing the sandbox-escape payload. When the script executes, the engine resolves the malicious construct and runs the attacker's operating system commands with the privileges of the PaperCut service account.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at the time of publication. Refer to the PaperCut Security Bulletin September 2026 for vendor technical detail.

Detection Methods for CVE-2026-14780

Indicators of Compromise

Newly created or recently modified device scripts that reference reflection, process, runtime, or shell objects not required for normal print workflows.
Child processes spawned by the PaperCut service account (for example cmd.exe, powershell.exe, /bin/sh, bash) outside of standard installer or update activity.
Outbound network connections initiated by the PaperCut host to unexpected destinations shortly after a script edit event in the admin console.

Detection Strategies

Audit the PaperCut administrative event log for script.edit, script.create, and device configuration changes correlated with administrator sessions.
Monitor endpoint telemetry for process-tree anomalies where the PaperCut Java process becomes the parent of an interactive shell or scripting interpreter.
Hunt for file system writes to temporary or world-writable directories performed by the PaperCut service account immediately following script execution.

Monitoring Recommendations

Forward PaperCut application logs and host process-creation events into a centralized SIEM for correlation across administrator activity and OS-level execution.
Baseline the normal device-scripting activity in your environment and alert on deviations in script count, size, or execution frequency.
Alert on administrative logins to the PaperCut console from untrusted networks or outside standard change windows.

How to Mitigate CVE-2026-14780

Immediate Actions Required

Apply the fixed PaperCut NG/MF release identified in the PaperCut Security Bulletin September 2026 as soon as possible.
Restrict network access to the PaperCut administrative interface to trusted management subnets and administrator jump hosts only.
Enforce multi-factor authentication on all PaperCut administrator accounts and rotate credentials suspected of exposure.
Review all existing device scripts and remove any entries that cannot be attributed to a documented change request.

Patch Information

PaperCut has released fixed versions addressing CVE-2026-14780. Administrators should consult the PaperCut Security Bulletin September 2026 for the specific patched build numbers that apply to their NG or MF deployment and follow the vendor's upgrade procedure.

Workarounds

Disable the device-scripting feature on servers where it is not operationally required until the patch is applied.
Limit the number of accounts holding administrative privileges on the PaperCut management console and audit remaining accounts for necessity.
Place the PaperCut host behind network segmentation that blocks outbound internet access except to vendor update endpoints, reducing post-exploitation value.

bash

# Configuration example: restrict admin interface exposure with host firewall (Linux)
# Replace 10.0.0.0/24 with your trusted management subnet
sudo iptables -A INPUT -p tcp --dport 9191 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9192 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9191 -j DROP
sudo iptables -A INPUT -p tcp --dport 9192 -j DROP