CVE-2026-82077

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

CVSS

7.3

EPSS

0.007 (53.1th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  ● Actively exploitedCritical 100watchTowr Labs◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards8 hours ago

  Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

  Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper! It still exists. We…

  ↗labs.watchtowr.com/death-by-a-thousand-papercut…(opens the publisher's site in a new tab)

What we observed