{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:32.606Z","products":["papercut"],"actNowTotal":1,"results":[{"query":"papercut","matched":1,"actNow":1,"events":[{"id":"kev-2026-08-31-papercut-ng-mf","url":"https://securitythreatpulse.com/events/kev-2026-08-31-papercut-ng-mf","title":"PaperCut NG MF: 2 flaws used in attacks; attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 63 days old, so current versions are being attacked. Ready-made attack tools are public. The severity score is critical (9.4). The exploit prediction score is 85%.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-81578","CVE-2026-82078"],"vendor":"PaperCut","product":"NG/MF","affectedProducts":[{"vendorKey":"papercut","productKey":"ngmf","vendor":"PaperCut","product":"NG/MF","slug":"papercut/ngmf","kind":"direct","evidence":["kev"]}],"category":{"id":"business-app","label":"Business software","why":"It runs day-to-day business work such as finance, printing, phones or manufacturing.","doThis":"Ask the vendor or the team that owns it whether the fix is in."},"summary":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.","cvss":9.4,"epss":0.84734,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-08-31","kevDueDate":"2026-09-14","firstSeenAt":"2026-08-31T00:00:00.000Z","updatedAt":"2026-10-30T23:37:41.203Z","newestEvidenceAt":"2026-10-28T01:37:04.194Z"}]}]}