PT-2026-67344 · Papercut · Papercut Ng/Mf

Vivien Lebas · CVE-2026-8793 · Published 2026-08-03 · Updated 2026-08-03

Mitre

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-8793

Affected Products

Papercut Ng/Mf

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-8793 · Security Note
• https://papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026 · Note