CISA added CVE-2026-82078, a critical unsafe reflection vulnerability in PaperCut NG/MF that allows execution of arbitrary Java bytecode on the print server, to its Known Exploited Vulnerabilities catalog on August 31, 2026.
What Is It
CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470) in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. An attacker able to manipulate system configuration parameters can use this to execute arbitrary Java bytecode already residing on the application classpath, running under the security context of the PaperCut server process.
CISA notes the flaw can be chained with CVE-2026-81578.
Why It Matters
NVD assigns a CVSS 3.1 base score of 9.1 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); the vendor-supplied CVSS 4.0 score is 9.4 (CRITICAL). The attack vector is network-based with low complexity and no user interaction, though high privileges are required. Scope is changed, with high confidentiality, integrity, and availability impact on both the vulnerable component and downstream systems.
CISA's SSVC assessment marks exploitation as active, with technical impact rated "total" and automatable "no." Its inclusion in the KEV catalog confirms exploitation in the wild. Known ransomware campaign use is listed as Unknown. A Metasploit Framework pull request referencing the issue is publicly tracked.
What's Vulnerable
PaperCut MF and PaperCut NG in the following ranges:
- All versions before 24.1.9
- 25.0.2 up to (but not including) 25.0.12
- 26.0.2 up to (but not including) 26.0.4
The fixed release on each branch is the upper bound of its affected range, 24.1.9, 25.0.12, and 26.0.4 respectively. Confirm the exact build for your branch against the vendor bulletin before patching.
Patch Status
PaperCut published an urgent security advisory dated August 27, 2026. CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 "Prioritizing Security Updates Based on Risk" and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: September 14, 2026.
Sources
- PaperCut Security Bulletin (27 Aug 2026), https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- NVD, CVE-2026-82078, https://nvd.nist.gov/vuln/detail/CVE-2026-82078
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements), https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Rapid7 Metasploit Framework PR #21842; https://github.com/rapid7/metasploit-framework/pull/21842