Vulnerability in Papercut Ng/mf
CVE-2026-8794
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
EPSS: 0.004 (32.4th percentile) — read the EPSS interpretation.
Affected products
- Papercut Ng/mf — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2026-8794?
- CVE-2026-8794 is a vulnerability in Papercut Ng/mf, classified under CWE-208. Published 2026-08-03.
- Is CVE-2026-8794 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.