CVE-2026-5115— Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices
Quick assessment
Affected
PaperCut Papercut NG/MF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PaperCut NG/MF是PaperCut公司的一个打印管理系统。 PaperCut NG/MF存在安全漏洞，该漏洞源于嵌入式应用程序与服务器之间的通信信道不安全，可能导致数据泄露，进而用于对设备发起攻击或对最终用户进行钓鱼攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5115
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices
Source: CVE Program / CVE List V5
Vulnerability Description
The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device.
It was internally discovered that the communication channel between the embedded application and the server was insecure, which could leak data including sensitive information that may be used to mount an attack on the device. Such an attack could potentially be used to steal data or to perform a phishing attack on the end user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
PaperCut NG/MF 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PaperCut NG/MF是PaperCut公司的一个打印管理系统。 PaperCut NG/MF存在安全漏洞，该漏洞源于嵌入式应用程序与服务器之间的通信信道不安全，可能导致数据泄露，进而用于对设备发起攻击或对最终用户进行钓鱼攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PaperCut | Papercut NG/MF | 0 ~ 25.0.5 | - |
|
II. Public POCs for CVE-2026-5115
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5115
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Papercut NG/MF
-
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax -
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsyste -
CVE-2026-8794
PaperCut NG/MF: User enumeration via timing attack -
CVE-2026-8793
PaperCut NG/MF: Insufficient brute-force protection
Same vendor: PaperCut
-
CVE-2026-11744
PaperCut Hive Embedded App for Ricoh: Javascript injection -
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax -
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsyste -
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Con
Same weakness: CWE-319
-
CVE-2026-103098
GV-Eye Sensitive information exposure in URL query parameter -
CVE-2026-64893
Johnson Controls EasyIO NEO <3.3b25 明文传输漏洞 -
CVE-2026-55396
Unencrypted UDP Control Traffic in Teledyne FLIR Robots runn -
CVE-2026-55394
Unencrypted 802.11 Network in Teledyne FLIR Robots running A -
CVE-2026-14984
Cleartext HTTP for Control Traffic in Teledyne FLIR Robots r
V. Comments for CVE-2026-5115
No comments yet