CVE-2026-5115
Last modified
CVE-2026-5115 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device. It was internally discovered that the communication channel between the embedded application and the server was insecure, which could leak data including sensitive information that may be used to mount an attack on the device. Such an attack could potentially be used to steal data or to perform a phishing attack on the end user.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device. It was internally discovered that the communication channel between the embedded application and the server was insecure, which could leak data including sensitive information that may be used to mount an attack on the device. Such an attack could potentially be used to steal data or to perform a phishing attack on the end user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Papercut | Papercut Mf | < 25.0.5 |
| Papercut | Papercut Mf Konica Minolta | < 25.0.9 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5115?
How severe is CVE-2026-5115?
How do I fix CVE-2026-5115?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5111The Gravity Forms plugin for WordPress is vulnerable to Stor…7.2
- CVE-2026-51119An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker …9.1
- CVE-2026-5112The Gravity Forms plugin for WordPress is vulnerable to Unau…7.2
- CVE-2026-5113The Gravity Forms plugin for WordPress is vulnerable to Stor…7.2
- CVE-2026-5114The SpeedyCache plugin for WordPress is vulnerable to Arbitr…4.9
- CVE-2026-51144Cross Site Scripting vulnerability in Soliton Systems MailZe…6.1
- CVE-2026-5116The Contact Form 7 – Dynamic Text Extension plugin for WordP…4.4
- CVE-2026-5118The Divi Form Builder plugin for WordPress is vulnerable to …9.8
- CVE-2026-5119A flaw was found in libsoup. When establishing HTTPS tunnels…8.2
- CVE-2026-51190The "s init" command in Serverless-Devs @serverless-devs/s <…9.8
- CVE-2026-5120A Race Condition vulnerability affecting BIOVIA Workbook fro…8.1
- CVE-2026-5121A flaw was found in libarchive. On 32-bit systems, an intege…7.5
Are you affected by CVE-2026-5115?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST