CVE-2026-6180 PaperCut MF: Card truncation on HP readers

Medium 4.1 Published 5 May 2026 Updated 5 May 2026

A race condition in PaperCut MF allows unauthorized session establishment via truncated badge IDs when custom post-processing scripts are enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-6180?

CVE-2026-6180 is a medium-severity vulnerability in PaperCut NG/MF, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes.

This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.

Weakness: CWE-367, CWE-20

Which versions are affected by CVE-2026-6180?

It affects 2 products.

Products include Papercut Papercut Mf, Papercut Papercut Ng.

How do I fix CVE-2026-6180?

No fix has been published for CVE-2026-6180 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-6180 being exploited?

There is no known exploitation of CVE-2026-6180 in the wild and no public exploit code.

Sources

Also known as GHSA-hqg4-rx24-2464.