T1190: PaperCut Unauthenticated Config Modification - CVE-2026-81578

Tim Peck@timpeck

•updated Aug 31, 2026•20•3•46

Detects unauthenticated HTTP POST requests to the PaperCut web management interface that attempt to modify server configuration settings. This behavior is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-81578, which may allow for unauthorized pre-authentication remote code execution.