EN PT-BR
← Voltar ao feed
high

CERT-FR: Multiple PaperCut NG/MF and Hive vulnerabilities allow remote code execution, data disclosure and XSS

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 21:00 · coletado há 5 dias

CERT-FR published an advisory on multiple vulnerabilities in PaperCut products. They are tracked as CVE-2026-11744, CVE-2026-14780, CVE-2026-82077 and CVE-2026-87739. According to the advisory, some of them let an attacker achieve remote arbitrary code execution, breach data confidentiality, bypass the security policy and perform indirect remote code injection (XSS). The advisory is based on the PaperCut security bulletin dated 23 October 2026. It reports no active exploitation and gives no CVSS scores or per-CVE details.

Entenda a falha

A vulnerabilidade

CERT-FR reports multiple vulnerabilities in PaperCut products, tracked as CVE-2026-11744, CVE-2026-14780, CVE-2026-82077 and CVE-2026-87739. Some of them allow remote arbitrary code execution, breach of data confidentiality, security policy bypass and indirect remote code injection (XSS). The advisory does not map impacts to individual CVEs, nor give CVSS scores or the prerequisites (authentication, configuration, user interaction). Affected: PaperCut Hive before 2.3.0, and PaperCut NG/MF 24.x before 24.1.11, 25.x before 25.0.13, 26.0.x before 26.0.5. Fixed in Hive 2.3.0, NG/MF 24.1.11, 25.0.13 and 26.0.5.

Como foi descoberta

The advisory only says that multiple vulnerabilities were discovered in PaperCut products. It does not name who found them or how they were reported. CERT-FR's advisory of 23 October 2026 is based on the PaperCut security bulletin of the same date (security-bulletin-sep-2026), and reports no active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 13:22.

Detalhes técnicos

  • Impact classes: remote code execution, confidentiality breach, security policy bypass and XSS. The advisory does not say which CVE maps to which impact.
  • Affected versions: PaperCut Hive before 2.3.0, PaperCut NG/MF 24.x before 24.1.11, 25.x before 25.0.13, and 26.0.x before 26.0.5.
  • No IOCs, threat actors or exploitation details are provided.

Remediação

  • Apply the fixes described in the PaperCut security bulletin (security-bulletin-sep-2026), as CERT-FR directs.
  • Update to PaperCut Hive 2.3.0, NG/MF 24.1.11, 25.0.13 or 26.0.5 or later.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR: Multiple PaperCut NG/MF and Hive vulnerabilities allow remote code execution, data disclosure and XSS

    ler a análise desta fonte

    CERT-FR published an advisory on multiple vulnerabilities in PaperCut products. They are tracked as CVE-2026-11744, CVE-2026-14780, CVE-2026-82077 and CVE-2026-87739. According to the advisory, some of them let an attacker achieve remote arbitrary code execution, breach data confidentiality, bypass the security policy and perform indirect remote code injection (XSS). The advisory is based on the PaperCut security bulletin dated 23 October 2026. It reports no active exploitation and gives no CVSS scores or per-CVE details.

    Technical Details

    • Impact classes: remote code execution, confidentiality breach, security policy bypass and XSS. The advisory does not say which CVE maps to which impact.
    • Affected versions: PaperCut Hive before 2.3.0, PaperCut NG/MF 24.x before 24.1.11, 25.x before 25.0.13, and 26.0.x before 26.0.5.
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in the PaperCut security bulletin (security-bulletin-sep-2026), as CERT-FR directs.
    • Update to PaperCut Hive 2.3.0, NG/MF 24.1.11, 25.0.13 or 26.0.5 or later.