CVE-2026-11744
📛 CVE Title
PaperCut Hive Embedded App for Ricoh: Javascript injection
Description
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- PaperCut
- CVSS severity
- LOW
- CVSS score
- 3.8 / 10
- CVSS vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U- Effective score
- 3.8 / 10 LOW source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-06-09
- Published
- 2026-09-24 06:51 UTC
- Last updated
- 2026-09-24 12:41 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/11xxx/CVE-2026-11744.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- EPSS score
- 0.0017 (probability of exploitation in next 30 days)
- EPSS percentile
- 5.41% vs all CVEs — higher = more likely to be exploited, as of 2026-09-24
NVD / KEV / EPSS data refreshed 2026-09-25 04:39 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85813 - Assigner
- PaperCut
- Published
- Sep 24, 2026, 6:51:03 AM
- Updated
- Sep 24, 2026, 12:41:33 PM
- EUVD base score (CVSS 4.0)
-
3.8 / 10
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U - EUVD-reported EPSS
- 0.1700
- Vendors
- PaperCut
- Products
-
PaperCut Hive (2.0.0 <2.3.0)
- Aliases
-
GHSA-wqwx-h8c4-gmvr
ENISA description: An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| PaperCut | PaperCut Hive |
2.0.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:cvefeed.io
The following table lists the changes that have been made to the CVE-2026-11744 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
2026-09-25 10:47 UTC -
web:cvetodo.com
CVE-2026-11744 is a Cross-Site Scripting (XSS) vulnerability in PaperCut Hive. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-09-25 10:47 UTC -
web:feedly.com
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary ...
2026-09-25 10:47 UTC -
web:learn.microsoft.com
Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...
2026-09-25 10:47 UTC -
web:security.glexia.com
CVE-2026-11744 is a Low severity, CVSS 3.8. Affecting PaperCut PaperCut Hive. Review impact, affected versions, remediation priorities, CWE and ATT&CK context.
2026-09-25 10:47 UTC -
web:securityvulnerability.io
What is CVE-2026-11744 ? An input validation issue exists in the PaperCut Hive embedded application for Ricoh devices, which does not properly sanitize input from NFC card readings.
2026-09-25 10:47 UTC -
web:support.microsoft.com
This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...
2026-09-25 10:47 UTC -
web:support.microsoft.com
This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5079420), improves functionality, performance, and reliability. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of ...
2026-09-25 10:47 UTC -
web:www.rapid7.com
CVE-2026-11744 : PaperCut PaperCut Hive: An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. View severity, references, and remediation details from Rapid7.
2026-09-25 10:47 UTC -
web:www.tenable.com
Microsoft patched 569 CVEs in July 2026 , the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.
2026-09-25 10:47 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-11744.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T12:40:59.451126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T12:41:33.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Embedded App for Ricoh"
],
"product": "PaperCut Hive",
"vendor": "PaperCut",
"versions": [
{
"lessThan": "2.3.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.<br>"
}
],
"value": "An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 3.8,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T06:51:03.813Z",
"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"shortName": "PaperCut"
},
"references": [
{
"url": "https://www.papercut.com/kb/Main/security-bulletin-sep-2026/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "PaperCut Hive Embedded App for Ricoh: Javascript injection",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"assignerShortName": "PaperCut",
"cveId": "CVE-2026-11744",
"datePublished": "2026-09-24T06:51:03.813Z",
"dateReserved": "2026-06-09T05:40:11.986Z",
"dateUpdated": "2026-09-24T12:41:33.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}