PaperCut Security Bulletin (24 September 2026 AEST; vulnerability log updated same day) discloses four issues fixed in current maintenance trains. PaperCut NG/MF: CVE-2026-14780 (CVSS 4.0 7.5 HIGH) — authenticated administrator RCE via optional Print/Device Scripting (disabled by default since 22.1.1; fixed earlier in 26.0.2 / 25.0.12); CVE-2026-82077 (CVSS 4.0 7.3 HIGH, watchTowr) — authenticated admin path-traversal/command injection in Scan-to-Fax; CVE-2026-87739 (CVSS 4.0 6.9 MEDIUM, internal) — unauthenticated remote attacker can trigger report generation and obtain sensitive report data (CWE-639).

PaperCut Hive Embedded Application for Ricoh: CVE-2026-11744 (CVSS 4.0 3.8 LOW) — local NFC-card XSS into the embedded webview sandbox. Vendor note: sites already on NG/MF 26.0.5 or 25.0.13 already have the NG/MF fixes; Hive Ricoh app → 2.3.0. Distinct from desk papercut-ng-mf-20260827 (Aug active-exploitation EPR / CVE-2026-82078/81578 wave) though patch floors overlap.

Primary: PaperCut bulletin.

UPDATE (12 Oct): watchTowr Labs published its full write-up on 9 October 2026 (US time; early 10 October Perth) showing that CVE-2026-82077, the Scan to Fax path traversal PaperCut rates as an authenticated-administrator flaw, completed an unauthenticated remote code execution chain against PaperCut NG 26.0.4-PO build 76508 when paired with WT-2026-0143, a further authentication bypass (no CVE assigned) that reaches the Setup Wizard forms through the Apache Tapestry service parameter and lets an attacker reset the admin password. watchTowr describes it as the second round of bypasses after the August in-the-wild chain (CVE-2026-81578 plus CVE-2026-82078): WT-2026-0141 and WT-2026-0142 defeated the first 26.0.4 fix and were closed in 26.0.4-PO build 76508; WT-2026-0143 was closed in 26.0.4-PO build 76530, and CVE-2026-82077 in 26.0.5. watchTowr also released a Detection Artefact Generator that checks exposure to the authentication bypasses. Any server still on a 26.0.4 emergency or PO build should be treated as reachable without a password and moved to a full maintenance release.

PaperCut's vulnerability log still shows its last update as 24 September.