Retrospective for 2026-10-24, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.
What this advisory changes in your environment
The starting point is CERTFR-2026-AVI-1377, published on 2026-10-23. Its scope includes PaperCut NG/MF, PaperCut Hive. Reported consequences are cross-site scripting (XSS), remote code execution, security control bypass, loss of confidentiality. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.
This case contains 4 version entries; CVE identifier count: 4. Track remediation by component: a successful overall update does not demonstrate that PaperCut NG/MF and PaperCut Hive each received their respective fix.
Products and versions to examine
- Reference
- CERTFR-2026-AVI-1377
- Source first published
- 2026-10-23
- Latest source revision available for this day
- 2026-10-23
- Named components
- PaperCut NG/MF, PaperCut Hive
- CVE identifiers
- CVE-2026-82077, CVE-2026-11744, CVE-2026-87739, CVE-2026-14780
| Component | Published condition |
|---|---|
| PaperCut NG/MF | 25.x : < 25.0.13 |
| PaperCut NG/MF | 24.x : < 24.1.11 |
| PaperCut NG/MF | 26.0.x : < 26.0.5 |
| PaperCut Hive | < 2.3.0. |
For PaperCut NG/MF, the published condition is “25.x : < 25.0.13”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of PaperCut NG/MF, PaperCut Hive does not close this case.
Mechanism and prerequisites
XSS abuses the trust a browser places in a page. Inspect untrusted content rendering, administrative sessions and output controls; input filtering alone does not establish that executable scripts are impossible.
The primary record CVE-2026-14780, published by PaperCut, covers PaperCut NG/MF. The retained revision is dated 2026-10-13. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-1377.
The published metric for CVE-2026-14780 is CVSS 4.0, 7.5/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- network
- Prior privileges
- high
- User interaction
- none
- Complexity
- low
- Additional attack requirements
- present
- Weakness
- CWE-94
Choose the appropriate intervention
- Locate PaperCut NG/MF instances, running releases and service owners. Record condition 25.x : < 25.0.13 in the ticket alongside reference CERTFR-2026-AVI-1377.
- Compare the installed branch with the vendor’s PaperCut NG/MF release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
- After changing PaperCut NG/MF, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.
Verify the fix in a real workflow
Validation scenario to adapt for PaperCut NG/MF, PaperCut Hive: For PaperCut NG/MF, capture the version loaded by the process or active kernel, then restart only as required by maintenance instructions. Check a dependent workflow and look for embedded copies in distributed images or executables. This is a proposed defensive check, not a claim that testing was performed against third-party systems.
Limit of case CERTFR-2026-AVI-1377: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.
Questions specific to this case
Which condition should be checked for PaperCut NG/MF?
Advisory CERTFR-2026-AVI-1377 states: PaperCut NG/MF — 25.x : < 25.0.13. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.
Why not use one fix for PaperCut NG/MF and PaperCut Hive?
CERTFR-2026-AVI-1377 distinguishes these components within a scope containing 4 entries. Match each branch to its own update documentation and functional check.
Which prerequisites does record CVE-2026-14780 specify?
For CVE-2026-14780, the published vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Verify those conditions on PaperCut NG/MF before applying them to an integration named in CERTFR-2026-AVI-1377.
Sources and related reading
Practical guide : Prioritize vulnerabilities and verify remediation
Explore the decision addressed in this case
- Magento Open Source, Adobe Commerce B2B: separate content from scripts
- MOVEit Transfer: separate content from scripts
Complete source advisory inventory
The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.
Official source · CERTFR-2026-AVI-1377
Advisory revision : · Checked on :
Affected systems · 4
Original French wording is retained to avoid ambiguous translations of version conditions.
- PaperCut NG/MF versions 25.x antérieures à 25.0.13
- PaperCut NG/MF versions 24.x antérieures à 24.1.11
- PaperCut NG/MF versions 26.0.x antérieures à 26.0.5
- PaperCut Hive toutes versions antérieures à 2.3.0.