PT-2026-36982 · Papercut · Papercut Mf

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-6180

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PaperCut MF (affected versions not specified)

Description A race condition occurs when processing badge-swipe data from specific HP multifunction devices. Under certain network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server might reject the initial data chunk but erroneously accept subsequent chunks before a connection reset is completed. This results in the registration of a truncated badge ID string. In environments using custom badge-ID post-processing scripts, this truncated string could be transformed into a valid ID of another user, allowing unauthorized session establishment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-20

CWE-367

Related Identifiers

CVE-2026-6180

Affected Products

Papercut Mf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6180 · Security Note
• https://papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026 · Vendor Advisory
• https://twitter.com/CVEnew/status/2051595422955884978 · Twitter Post
• https://t.me/CVEtracker/52722 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051596964123320666 · Twitter Post