CVE-2026-8794

PaperCut NG/MF: User enumeration via timing attack

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

Affected

PaperCut · PaperCut NG/MF

CVSS v4.0 CNA

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.68% chance of exploitation in the next 30 days, 51st percentile

Published

2026-08-03

Proof-of-concept exploits (1)

• H4zaz/CVE-2026-87940★ · 2026-08-15

References

• CVE Record
• NVD entry

Related

• CVE-2025-60500
• CVE-2026-42141