CVE-2026-14780 PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
An authenticated administrator can execute arbitrary OS commands via malicious scripts in PaperCut NG/MF, leading to full host compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14780?
CVE-2026-14780 is a high-severity code injection vulnerability in PaperCut NG/MF, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.
A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
Weakness: CWE-94
Which versions are affected by CVE-2026-14780?
How do I fix CVE-2026-14780?
No fix has been published for CVE-2026-14780 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-14780 being exploited?
There is no known exploitation of CVE-2026-14780 in the wild and no public exploit code.
Sources
Also known as GHSA-rrvj-pgxj-7php.