CVE-2026-87739CWE-639

CVE-2026-87739

published September 24, 2026

CVSS
6.9
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-24T11:16Z
References (1)
https://www.papercut.com/kb/Main/security-bulletin-sep-2026/ · eb41dac7-0af8-4f84-9f6d-0272772514f4
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 24 SEP 06:46Z
    PaperCut MF/NG: User permissions are not evaluated on report generation
    cvelistv5