CVE-2026-8794

Summary

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

Affected Software

Weaknesses

• CWE-208: CWE-208 Observable timing discrepancy

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/

• ←Previous
• Next→