CISA KEV Alert: CVE-2026-81578 — PaperCut NG/MF Missing Authentication for...

Executive Summary

The CISA KEV catalog now flags CVE‑2026‑81578 in PaperCut NG/MF as an actively exploited missing‑authentication flaw that lets unauthenticated remote actors modify system configurations. All entities running PaperCut NG/MF—including federal agencies and private organizations—must decide immediately whether to apply the vendor‑issued mitigation or suspend the service before the September 14 2026 remediation deadline. Failure to act risks configuration‑driven service outages, regulatory non‑compliance, and potential breach liability.

Verified Facts

• CVE‑2026‑81578 affects PaperCut NG/MF and is a missing‑authentication vulnerability for a critical function — CISA KEV Alert.
• The vulnerability permits an unauthenticated remote attacker to modify certain system configurations — CISA KEV Alert.
• Exploitation can be chained with CVE‑2026‑82078 — CISA KEV Alert.
• The vulnerability was added to the KEV list on 2026‑08‑31 with a federal remediation deadline of 2026‑09‑14 — CISA KEV Alert.
• Required action is to apply vendor‑provided mitigations and follow CISA BOD 26‑04 and Forensics Triage Requirements — CISA KEV Alert.

Threat Classification

This is a vulnerability‑exploitation threat (active exploitation confirmed) targeting any organization that deploys PaperCut NG/MF, primarily within the United States federal and private sectors (HIGH CONFIDENCE). The attacker’s motivation is not disclosed in the source (MEDIUM CONFIDENCE). Exploitation status is active (HIGH CONFIDENCE).

Threat Severity Assessment

• Exploitability: Remote, unauthenticated access to a critical configuration function (HIGH CONFIDENCE).
• Impact: Direct modification of system configurations can disrupt printing services and potentially expose downstream data (HIGH CONFIDENCE).
• Active exploitation confirmed in the advisory title (HIGH CONFIDENCE).
• Short remediation window (deadline within two weeks) increases urgency (MEDIUM CONFIDENCE).

Overall Severity: CRITICAL

Business Impact

Unauthenticated configuration changes can render print services unavailable, causing production downtime and breach of service‑level agreements. If altered configurations expose or exfiltrate personal data, organizations may incur GDPR or NIS2 penalties, with fines ranging up to €20 million or 4 % of global turnover (applicable under EU law). In the U.S., failure to remediate by the federal deadline could trigger non‑compliance findings under FedRAMP or impact SOC 2 audit outcomes, leading to loss of certification and client trust.

Technical Analysis

• Attack Vector: Unauthenticated remote HTTP request to a missing‑authentication endpoint within PaperCut NG/MF.
• Exploitation Chain: Can be combined with CVE‑2026‑82078 to deepen impact.
• Affected Component: Critical configuration function that governs system settings.
• Root Cause: Absence of authentication checks on the configuration API.
• Mitigation: Vendor‑issued configuration hardening steps; no specific patch version cited.

CVE Analysis

• CVE‑2026‑81578 — PaperCut NG/MF — Missing authentication on a critical configuration function — Remote unauthenticated exploitation — Mitigations available per vendor advisory (no specific patch version disclosed).

MITRE ATT&CK Mapping

• Impact → T1609: Modify System Configuration — The vulnerability allows an attacker to change system configuration without authentication.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• Unauthenticated HTTP POST/PUT requests to PaperCut NG/MF configuration endpoints.
• Requests containing the string “CVE‑2026‑81578” or “CVE‑2026‑82078” in URLs or payloads.
• Successful configuration change responses (HTTP 200) from sources lacking authentication headers.
• Outbound connections from the PaperCut server to unknown external IPs shortly after a configuration change.

Detection Engineering Guidance

• Log Sources: Web server access logs (e.g., Apache/Nginx), PaperCut application logs, firewall NetFlow, and Windows Event Log 4624 (logon) for missing auth events.
• Detection Logic: Flag any HTTP request to “/admin/config*” or similar endpoint that returns 200 OK while the “Authorization” header is absent or empty.
• Telemetry Fields: source IP, request method, URL path, response status, presence of Authorization header, timestamp.
• Rationale: Directly correlates to the unauthenticated configuration change described in the advisory.

Sigma Rules

title: PaperCut NG/MF Unauthenticated Configuration Change
id: 123e4567-e89b-12d3-a456-426614174001
status: stable
description: Detects HTTP requests to PaperCut NG/MF configuration endpoints that succeed without authentication.
author: CYBERDUDEBIVASH Sentinel APEX
date: 2026-08-31
logsource:
    product: webserver
    service: http
detection:
    selection:
        uri|contains: ['/admin/config', '/api/config']
        status: 200
        Authorization|exists: false
    condition: selection
falsepositives:
    - Legitimate internal automation without auth (rare)
level: high
tags:
    - attack.t1609

Threat Hunting Queries

• Hypothesis: Unauthenticated configuration API calls from external IPs — Source: Web server access logs (uri, status, Authorization header).
• Hypothesis: Sudden spikes in configuration change events without corresponding admin logins — Source: PaperCut application logs + Windows Event ID 4624.
• Hypothesis: Network flows from PaperCut server to unknown external destinations after config changes — Source: NetFlow/SIEM flow records.
• Hypothesis: Presence of “CVE‑2026‑81578” string in request payloads — Source: Deep packet inspection logs.
• Hypothesis: Chained exploitation attempts that also target CVE‑2026‑82078 endpoints — Source: Web server logs for both CVE identifiers.

🔗 Related Intelligence Reports

• Same vulnerability: CISA KEV Alert: CVE-2026-82078 — PaperCut NG/MF Unsafe Reflection Vulnerability | Active E
• Related topic: CVE-2026-82473 — CVSS 8.2 HIGH Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82285 — CVSS 8.2 HIGH Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82460 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CISA KEV Alert: CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a