CVE-2026-8794

unknowncovered by 1 sourcefirst seen 2026-08-03

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

⚡ Watch CVE-2026-8794

Get an email if CVE-2026-8794 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-8794: PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An un…nvd · 2026-08-03

External references

NVD record for CVE-2026-8794

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-8794 status](https://www.csirts.com/badge/CVE-2026-8794)](https://www.csirts.com/cve/CVE-2026-8794)