CVE-2026-6180: 
PaperCut NG vulnerability analysis and mitigation

CVE-2026-6180 is a race condition (TOCTOU) vulnerability in PaperCut MF and PaperCut NG that can lead to unauthorized session establishment via badge-swipe authentication bypass on HP multifunction devices. The vulnerability was published on May 5, 2026, and affects PaperCut MF and NG versions prior to 24.1.9 (24.x branch) and versions 25.0.2 up to (but not including) 25.0.10 (25.x branch). It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 4.1 (Medium), reflecting the high-complexity network conditions required for exploitation (GitHub Advisory, PaperCut Advisory).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with improper input validation (CWE-20) in PaperCut's handling of badge-swipe data from HP multifunction devices. Under specific adverse network conditions — dropped packets and out-of-order sequence counters — the server may reject an initial data chunk while erroneously accepting subsequent fragmented chunks before a connection reset completes, resulting in registration of a truncated badge ID string. The vulnerability is only practically exploitable in environments where custom badge-ID post-processing scripts are deployed, as these scripts may transform the truncated string into a valid ID belonging to a different user, enabling unauthorized session establishment (GitHub Advisory, PaperCut Advisory).

Successful exploitation results in an authentication bypass, allowing an attacker to establish an unauthorized session on the HP multifunction device as a different, legitimate user ("Incorrect User Login"). This primarily impacts confidentiality, as the attacker gains access to print jobs, scanned documents, and device functions belonging to the impersonated user. The integrity of audit logs and access controls is also undermined, though availability is not directly affected. The scope is limited to environments using both HP multifunction devices integrated with PaperCut and custom badge-ID post-processing scripts (GitHub Advisory, PaperCut Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.04–0.121%, placing it in the 31st percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific network conditions (dropped packets, out-of-order delivery), physical or network proximity to the badge reader infrastructure, and the presence of custom badge-ID post-processing scripts, making opportunistic mass exploitation unlikely.

1. Reconnaissance: Identify target environments running PaperCut MF or NG (versions < 24.1.9 or 25.0.2–25.0.9) integrated with HP multifunction devices and badge-swipe authentication.
2. Assess configuration: Determine whether the target PaperCut deployment uses custom badge-ID post-processing scripts, as exploitation is only viable in such environments.
3. Network manipulation: Position on the network path between the HP multifunction device and the PaperCut server to induce dropped packets and out-of-order sequence counters during badge-swipe data transmission (e.g., via packet injection or network disruption tools).
4. Trigger race condition: Cause a sequence reset notification to fail to reach the PaperCut server during a badge-swipe event, so the server rejects the initial data chunk but accepts subsequent fragmented chunks, registering a truncated badge ID.
5. Exploit post-processing script: Rely on the custom badge-ID post-processing script to transform the truncated badge ID into a valid ID belonging to a different user.
6. Unauthorized session establishment: The PaperCut server authenticates the session as the target user, granting the attacker access to that user's print jobs, scanned documents, and device functions on the HP multifunction device (GitHub Advisory, PaperCut Advisory).

• Logs: PaperCut server logs showing badge authentication events where a user session is established with a badge ID that does not match the full expected badge ID length; repeated authentication attempts with truncated badge IDs from the same HP device.
• Logs: Entries indicating sequence counter anomalies or connection resets during badge-swipe processing in PaperCut application logs.
• Network: Unusual packet loss or out-of-order TCP segments on the network segment between HP multifunction devices and the PaperCut server, potentially indicating deliberate network manipulation.
• Application: Audit trail entries in PaperCut showing a user session initiated at an HP device that the legitimate user did not perform, particularly during periods of network instability.
• Application: Evidence of custom badge-ID post-processing script execution resulting in ID transformations that map to a different user than the badge presented.

PaperCut has released patched versions addressing this vulnerability: update PaperCut MF and PaperCut NG to version 24.1.9 or later (for the 24.x branch) or 25.0.10 or later (for the 25.x branch) (PaperCut Advisory). As interim mitigations, administrators should review and harden any custom badge-ID post-processing scripts to ensure truncated IDs cannot be transformed into valid user IDs belonging to other users. Additionally, improving network reliability between HP devices and the PaperCut server (reducing dropped packets and out-of-order delivery) reduces the likelihood of triggering the race condition. Organizations not using custom badge-ID post-processing scripts are at significantly lower risk but should still apply patches promptly.

PaperCut issued a security bulletin in May 2026 addressing this and other vulnerabilities, providing patched versions and remediation guidance (PaperCut Advisory). Tenable released Nessus detection plugins (IDs 313099 and 313100) for this vulnerability shortly after disclosure. Coverage was noted across standard vulnerability aggregation platforms (VulnDB, CVEfeed, INCIBE-CERT), but no significant independent researcher commentary or social media discussion has been observed, consistent with the vulnerability's moderate severity and narrow exploitation conditions.