CVE-2026-87739: PaperCut MF/NG Auth Bypass Vulnerability

CVE-2026-87739 Overview

CVE-2026-87739 is an improper authentication vulnerability in PaperCut MF and PaperCut NG print management software. The flaw allows an unauthenticated, remote attacker to trigger report generation by submitting crafted requests without valid credentials. Successful exploitation exposes sensitive information contained within generated reports, including print job metadata, user activity, and operational data. The weakness is tracked as [CWE-639] (authorization bypass through user-controlled key).

Critical Impact
An unauthenticated remote attacker can trigger PaperCut report generation and read sensitive print and user data without any credentials or user interaction.

Affected Products

PaperCut MF (print management for multi-function devices)
PaperCut NG (network print management server)
Refer to the PaperCut Security Bulletin September 2026 for the specific affected versions

Discovery Timeline

2026-09-24 - CVE CVE-2026-87739 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-87739

Vulnerability Analysis

The vulnerability resides in the report generation endpoints exposed by PaperCut MF/NG. These endpoints should require an authenticated administrative session before accepting report requests. Due to improper authentication enforcement, the server processes report generation requests even when the submitter has no valid session or credentials.

An attacker can submit report generation parameters directly to the vulnerable endpoint over the network. The server returns or stores the resulting report, exposing data that PaperCut normally restricts to administrators. Exposed content can include user print activity, document names, device usage, and billing information.

The impact is limited to confidentiality. The flaw does not grant code execution, write access, or availability impact against the PaperCut service. However, the leaked data can support reconnaissance for broader attacks against users and connected systems.

Root Cause

The root cause is missing or incomplete authorization checks on the report generation handler. [CWE-639] describes this pattern: the application exposes a function keyed by a parameter the client supplies, without validating that the requester is permitted to access that function or object. The server trusts the request context rather than verifying session state.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker reaches the PaperCut web interface, typically exposed on TCP ports 9191 or 9192, and issues an unauthenticated HTTP request to the report generation path. No authentication tokens or session cookies are required for the request to succeed. Internet-exposed PaperCut servers face the highest risk, though attackers with internal network access can also exploit the flaw.

No verified public exploit code is available at the time of writing. See the PaperCut Security Bulletin September 2026 for vendor technical details.

Detection Methods for CVE-2026-87739

Indicators of Compromise

Unexpected report files appearing in PaperCut report output directories outside of scheduled jobs
HTTP requests to PaperCut report generation endpoints lacking a valid authenticated session cookie
Report generation events in PaperCut application logs attributed to anonymous or unknown users
Outbound responses from the PaperCut server to untrusted source IP addresses containing report payloads

Detection Strategies

Review PaperCut server.log and admin audit logs for report generation events that do not correlate to a logged-in administrator session
Baseline normal report generation volume and alert on spikes or off-hours activity
Inspect web server access logs for unauthenticated POST or GET requests to report-related URIs on ports 9191 and 9192

Monitoring Recommendations

Forward PaperCut application and web logs to a centralized SIEM for correlation with network telemetry
Monitor network flows to and from PaperCut servers, flagging access from outside expected administrative subnets
Enable alerts for any new source IP addresses interacting with report generation endpoints

How to Mitigate CVE-2026-87739

Immediate Actions Required

Apply the vendor patch referenced in the PaperCut Security Bulletin September 2026 as soon as it is available for your deployment
Remove direct internet exposure of the PaperCut administrative interface and restrict access to trusted management networks
Audit historical logs for signs of unauthorized report generation prior to patching
Rotate any credentials or shared secrets that may have been exposed through generated reports

Patch Information

PaperCut has published remediation guidance in the PaperCut Security Bulletin September 2026. Administrators should consult the bulletin for the exact fixed versions of PaperCut MF and PaperCut NG and upgrade according to vendor instructions.

Workarounds

Place the PaperCut server behind a reverse proxy or VPN that enforces authentication before requests reach the application
Restrict inbound access to PaperCut ports 9191 and 9192 using firewall rules that allow only known administrative source addresses
Disable or firewall off the report generation endpoints at the network layer until the patch is applied

bash

# Example iptables rules restricting PaperCut web access to an administrative subnet
iptables -A INPUT -p tcp --dport 9191 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9192 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP
iptables -A INPUT -p tcp --dport 9192 -j DROP