VulnerabilityAwaiting Analysis

CVE-2026-8794

An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts.

MEDIUM 6.9EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-208
Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

References

https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.