A Medium CVSS score can hide a patch-priority conflict. CVE-2026-87739 is rated 6.9 under CVSS 4.0, yet the vendor says an unauthenticated remote requester can trigger report generation and access sensitive information in PaperCut NG/MF. The score is useful, but the business decision must also consider reachability and the value of the reports.
The vulnerability is a permission-check failure. PaperCut describes user permissions as not evaluated on report generation and classifies the weakness as CWE-639, Authorization Bypass Through User-Controlled Key. The attack requires network access, no privileges, no user interaction, and low attack complexity. The vendor's vector also marks automatable as yes.
Read the score in context
The CVSS 4.0 vector lists low confidentiality impact and no integrity or availability impact. That assessment produces a Medium base score. It does not say that every report is harmless. Reports can carry operational, financial, or employee information, and the same server may serve several business units.
CISA's Vulnrichment adds an SSVC record with exploitation none, automatable yes, and technical impact partial. The vendor bulletin states that PaperCut has no evidence of exploitation. These signals support urgent remediation without declaring an active incident.
The score also does not remove the authentication problem. A Medium vulnerability with no privilege requirement can be exposed to a much larger requester population than a high-severity flaw that requires an administrator session.
Estimate exposure
Start with a simple risk question: can the PaperCut report function be reached from a network that does not require strong administrative trust? If yes, the second question is what data the available reports contain.
Use both internal inventory and external observations. The ZoomEye query recorded for this review returned 1,266,845 matches for app="PaperCut" and zero for vul.cve="CVE-2026-87739". The first figure is a broad product-fingerprint count, not a count of vulnerable servers. The zero Filter result does not prove that no vulnerable system exists.
Do not put that number in a board paper as "1.3 million vulnerable PaperCut systems." Use it as a discovery signal and replace it with verified internal version and reachability counts.
Set the decision threshold
PaperCut NG/MF releases before 26.0.5 are affected. The fixed targets are 25.0.13 for the 25.x branch and 24.1.11 for the 24.x branch. One table cell in the bulletin refers to 24.1.10, so a conservative program should use 24.1.11 and seek clarification when a build-attestation dispute matters.
A defensible priority order is:
- 1.
Internet-facing or broadly reachable affected servers with sensitive report output.
- 2.
Affected servers reachable from large user, student, guest, or partner networks.
- 3.
Internally segmented servers that still have a reachable report path.
- 4.
Affected servers whose report function is demonstrably unreachable and that have a documented compensating control.
The order should reflect verified facts. A server with no exposed report interface is not automatically risk-free, but it should not be placed ahead of a confirmed broadly reachable system without a reason.
Choose the response
The primary response is an upgrade to a fixed release. Temporary network restrictions can reduce exposure while the maintenance window is scheduled. Monitoring can provide evidence of report activity. Neither is a substitute for the fixed build.
Report owners should confirm which data is available and whether recent output appears outside the expected schedule. Security operations should review report-related activity where logs permit. The data owner, platform owner, and network owner may each hold part of the answer.
Record the residual risk
If a system cannot be patched immediately, document the remaining version, report reachability, data classification, containment, monitoring, owner, and accepted deadline. PaperCut published no universal configuration workaround, so the risk owner should not describe a local rule as a complete mitigation.
Review the record when the system is patched and validate both the unauthenticated denial and the authorized report path. Remove temporary controls that no longer serve a purpose, and keep any architectural restriction that remains necessary.
The executive summary
CVE-2026-87739 is a Medium-scored authorization bypass with no privilege requirement and a direct path to report data. The right decision is to patch every affected branch promptly, prioritize broadly reachable systems with sensitive output, and avoid equating a vendor product count with a vulnerable population.
That framing supports action without overstatement. It also gives leadership a measurable completion condition: fixed builds on all affected servers, verified report authorization, and documented residual risk where the upgrade remains incomplete.
References
PaperCut security bulletin: https://www.papercut.com/kb/Main/security-bulletin-sep-2026/
CERT-FR advisory: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1377/
CVE record: https://www.cve.org/CVERecord?id=CVE-2026-87739