HIGHVulnerability
Verified
Global

CISA KEV: PaperCut NG/MF — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

Analysis

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-28. Remediation due: 2026-09-11.

Indicators of Compromise (2)

CVE (2)
CVE-2026-82078
NVDMITRE CVE
CVE-2026-81578
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 28, 2026. Verified by: CISA.

Related Threats

LOWVulnerabilityNEW

Microsoft’s X account hacked in crypto pump-and-dump scheme

On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-97637 — The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass vi...

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()

CVE-2026-97637
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15896 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to...

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no au

CVE-2026-15896
NIST NVD