What’s Vulnerable › Vulnerabilities
CVE-2026-5115: Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-31 · updated 2026-06-17
- Weakness: CWE-319
Description
The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device. It was internally discovered that the communication channel between the embedded application and the server was insecure, which could leak data including sensitive information that may be used to mount an attack on the device. Such an attack could potentially be used to steal data or to perform a phishing attack on the end user.
Affected products
- PaperCut MF: before 25.0.5 — fixed in 25.0.5
- Papercut Mf Konica Minolta: before 25.0.9 — fixed in 25.0.9
How to fix
Upgrade to a fixed version: PaperCut MF 25.0.5; Papercut Mf Konica Minolta 25.0.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-5115 or the next vulnerability affects your stack