CVE-2026-14780— PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
Quick assessment
Affected
PaperCut PaperCut NG/MF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PaperCut NG/MF 平台的设备脚本功能中存在一个漏洞，原因是嵌入式执行引擎对输入的净化处理不足且访问控制措施薄弱。具有管理界面管理员权限的认证用户可以注入恶意脚本，从而突破运行时沙箱限制。 成功利用该漏洞后，攻击者可以在主机操作系统上以管理员权限执行未授权的操作系统命令。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PaperCut | PaperCut NG/MF | < 25.0.12 |
affected |
26.0.0< 26.0.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14780
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.
A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PaperCut | PaperCut NG/MF | 0 ~ 25.0.12 | - |
|
II. Public POCs for CVE-2026-14780
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14780
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14780 (1)
Same Patch Batch · PaperCut · 2026-09-24 · 4 CVEs total
| CVE-2026-82077 | 7.3 HIGH | PaperCut NG/MF: Remote Code Execution via Scan2Fax |
| CVE-2026-87739 | 6.9 MEDIUM | PaperCut MF/NG: User permissions are not evaluated on report generation |
| CVE-2026-11744 | 3.8 LOW | PaperCut Hive Embedded App for Ricoh: Javascript injection |
IV. Related Vulnerabilities
Same product: PaperCut NG/MF
-
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax -
CVE-2026-8794
PaperCut NG/MF: User enumeration via timing attack -
CVE-2026-8793
PaperCut NG/MF: Insufficient brute-force protection -
CVE-2026-6418
PaperCut NG/MF: Path Traversal in Shared Account Synchroniza
Same vendor: PaperCut
-
CVE-2026-11744
PaperCut Hive Embedded App for Ricoh: Javascript injection -
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax -
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Con -
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
Same weakness: CWE-94
-
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitr -
CVE-2026-102130
Kiteworks Email Protection Gateway Remote Code Execution -
CVE-2026-102131
Kiteworks Email Protection Gateway Improper Handling of Case -
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host -
CVE-2026-96349
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution
V. Comments for CVE-2026-14780
No comments yet