Loading vulnerability…
Authenticated Command Execution via Scan-to-Fax Path Traversal in PaperCut NG/MF
CVE-2026-82077 is a path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF. FaxProviderManagerImpl.sendFaxJob appends an attacker-controlled providerConnector value to the fax connector directory without validating that the resulting path remains within that directory. An authenticated administrator can use relative path traversal to select another executable, control its arguments through the fax command-arguments setting, and trigger execution through ProcessUtils.execAndGetOutput. The vulnerability was demonstrated against PaperCut NG 26.0.4-PO build 76508 and fixed in version 26.0.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution with the privileges of the PaperCut service, potentially compromising the confidentiality, integrity, and availability of the host and data accessible to that account. When combined with the separate WT-2026-0143 authentication bypass, the vulnerability enables unauthenticated remote code execution against PaperCut NG 26.0.4-PO build 76508. In-the-wild exploitation of this specific vulnerability has not been established.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict PaperCut administrative and application access to trusted networks and authorized users, and monitor for anomalous administrative activity and web requests. These measures reduce exposure but do not correct the vulnerability. No vulnerability-specific interim workaround is established.
Patch, then assume compromise.
Upgrade PaperCut NG/MF 26.x to version 26.0.5 or later, which addresses CVE-2026-82077. For other supported release branches, apply the corresponding vendor security update and verify its applicability in the September 2026 PaperCut security bulletin. Updating only to 26.0.4-PO build 76530 addresses the separate WT-2026-0143 authentication bypass, not this command-execution vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.