VulnSocial

CVE-2026-8794Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-208

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-04: 1Technical Details · 2026-08-04: 108-04
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Autumn Good@autumn_good_35
    Disclosure

    2つを組み合わせることでブルートフォースによる突破率が向上しそうですね... CVE-2026-8793: Insufficient brute-force protection CVE-2026-8794: User enumeration via timing attack PaperCut NG/MF Security Bulletin (3 Aug 2026) https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/

    Post summary

    The text announces two new CVEs highlighted in a PaperCut NG/MF security bulletin, describing core technical weaknesses such as insufficient brute‑force protection and user enumeration via timing attack, but offers no PoC, exploit tool, active exploitation details, or patch information.

    00000450
    7.0K followersView on X

Explore more

Back to dashboard