PT-2026-67345 · Papercut · Papercut Ng/Mf

Vivien Lebas · CVE-2026-8794 · Publicado 2026-08-03 · Atualizado 2026-08-03

NVD

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

Correção

Enumeração de Fraquezas

CWE-208

Identificadores relacionados

CVE-2026-8794

Produtos afetados

Papercut Ng/Mf

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-8794 · Nota de Segurança
• https://papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026 · Nota