CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Flaw in CISA KEV Enables Java Bytecode Execution

TL;DR

CVE-2026-82078 is an unsafe reflection vulnerability (CWE-470) in PaperCut NG and PaperCut MF that lets an attacker who can manipulate system configuration parameters load arbitrary Java classes from the application classpath and execute code under the PaperCut server process context. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-31 with a remediation due date of 2026-09-14, and it can be chained with the authentication bypass CVE-2026-81578. Patch to the vendor's fixed releases (24.1.10, 25.0.13, or 26.0.5) or apply the compensating controls below today.

What is this vulnerability?

Field	Detail
CVE	CVE-2026-82078
Vendor / Product	PaperCut / NG and MF
Vulnerability name	PaperCut NG/MF Unsafe Reflection Vulnerability
Weakness	CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection)
CISA KEV added	2026-08-31
CISA KEV due date	2026-09-14
Known ransomware use	Unknown
CVSS v3.1 (NVD)	9.1 CRITICAL — AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0	9.4 CRITICAL — AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS	0.03574 (88.8th percentile)
Required action	Apply mitigations per vendor instructions; follow CISA BOD 26-04 and the associated forensics triage requirements

Overview

CVE-2026-82078 is an unsafe dynamic class loading vulnerability in the database connection utilities of PaperCut MF and PaperCut NG. PaperCut instantiates database driver classes based on a configurable driver name, but it does not validate that name against an allowlist of approved drivers. When an attacker can manipulate system configuration parameters, they can point the loader at any class already present on the application classpath and cause it to execute as Java bytecode under the security context of the PaperCut server process.

The vendor published an urgent security advisory on 27 August 2026, and the issue was disclosed publicly on 27–28 August 2026. CISA added CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on 31 August 2026 with a remediation due date of 14 September 2026, which is the clearest signal that exploitation has been observed in the wild. The vulnerability is explicitly described as chainable with CVE-2026-81578, an authentication bypass that can supply the configuration-manipulation primitive. Defenders should treat the two as a single combined attack path rather than isolated bugs.

Affected version ranges include PaperCut MF/NG prior to 24.1.10, 25.0.2 through 25.0.12, and 26.0.2 through 26.0.4. NVD rates the flaw as CRITICAL at 9.1 under CVSS 3.1, while a CVSS 4.0 assessment places it at 9.4; both vectors describe network reachability, low attack complexity, and high impact across confidentiality, integrity, and availability. The EPSS score is modest at roughly 0.036 (88th percentile), but the KEV listing, the public proof-of-concept repositories, and the observed exploitation campaign raise the practical urgency well above what EPSS alone suggests. Anyone running PaperCut NG or MF — particularly print management servers exposed to internal networks or the internet — should treat this as a priority patch item.

Technical details

The root cause sits in PaperCut's database connection utilities. The application dynamically instantiates database driver classes based on a configurable JDBC driver class name, but it does not restrict that input to an approved allowlist. Because the driver name is externally controllable through system configuration parameters, an attacker who can influence that configuration can specify a malicious or abusable driver class already present on the application classpath — such as the H2 or Apache Derby JDBC drivers — and trigger arbitrary Java bytecode execution. This is a classic CWE-470 pattern: untrusted input selects which code gets loaded and executed.

• Vulnerable component: PaperCut database connection utilities and the external user lookup configuration path.
• Attack prerequisites: The ability to manipulate system configuration parameters. In practice this means a privileged position — an administrative account, access to the configuration interface, or a chained vulnerability such as CVE-2026-81578 that grants that access.
• Network exposure: PaperCut NG/MF typically listens on port 9191 for its web interface, including the admin and configuration surfaces. Internet-facing instances are the highest-risk population.
• Authentication requirements: The vulnerability itself requires configuration access (PR:H in both CVSS vectors), but the companion CVE-2026-81578 is an authentication bypass, so the chain can be reached without valid credentials.
• Execution context: Arbitrary Java bytecode runs under the security context of the PaperCut server process — typically SYSTEM on Windows or a dedicated service account on Linux.
• Affected version ranges:
  • PaperCut MF/NG prior to 24.1.10
  • PaperCut MF/NG 25.0.2 through 25.0.12
  • PaperCut MF/NG 26.0.2 through 26.0.4

The trust boundary that fails here is between configuration data and executable code; PaperCut treats a configuration string as a class name without constraining it to a known-safe set. Two public GitHub repositories referencing the CVE pair are visible, which lowers the bar for opportunistic actors.

Impact

Successful exploitation results in remote code execution under the security context of the PaperCut server process, which typically runs as SYSTEM on Windows or as a dedicated service account on Linux. This grants attackers full confidentiality, integrity, and availability impact on the affected server, including the ability to exfiltrate print job data, user credentials, and configuration secrets. Attackers have been observed deploying Meterpreter payloads and remote access tools, stealing credentials, and using compromised PaperCut servers as a pivot point for lateral movement within enterprise and education networks.

Because PaperCut often integrates with directory services and database backends, a compromised server can become a pivot point for broader enterprise access. An attacker could read or alter print job data, extract credentials and connection strings, modify system configuration, disable auditing, or use the server as a foothold for lateral movement into adjacent systems. The chaining with CVE-2026-81578 is especially concerning: if the companion flaw provides the configuration manipulation primitive, the combination may allow an unauthenticated or low-privileged attacker to reach full code execution.

An AI-orchestrated campaign reportedly compromised 395–440 organizations across 48 countries by chaining CVE-2026-81578 with CVE-2026-82078. Business exposure includes regulatory notification obligations, operational disruption to printing and accounting workflows, and potential ransomware staging, although known ransomware use for this CVE is currently listed as unknown. The education sector — particularly U.S. and European schools and universities — was prominently targeted.

Exploitability

CVE-2026-82078 is listed in CISA KEV (added 2026-08-31, due 2026-09-14), which confirms exploitation in the wild. The EPSS score is 0.03574, placing it at the 88.8th percentile — modest on its own, but the KEV listing and public tooling materially change the risk picture. Two public exploit/PoC references are visible:

• GitHub: https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
• GitHub: https://github.com/virologi-info/papercut-toolkit

A Metasploit module implements two execution paths: H2 JDBC URL injection for version 26.x (in-memory execution) and Derby class-drop-and-load for versions 24.x–25.x. Rapid7 noted that the vendor's second emergency patch successfully remediated the exploit chain. GreyNoise documented an AI-orchestrated exploitation campaign that compromised 395–440 organizations across 48 countries, with some reporting that 11 organizations were breached in as little as 26 seconds.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed exploitation in the wild; carries a binding remediation deadline for federal agencies	Treat as emergency. Remediate by 2026-09-14. Verify exposure and hunt for compromise now.
CVSS v3.1 9.1 / v4.0 9.4	Theoretical severity of the flaw (network reachable, low complexity, high CIA impact)	Use to justify emergency change windows and resource allocation.
EPSS 0.03574 (88.8th pct)	Probability of exploitation in the next 30 days based on observed activity	Do not let the low absolute score deprioritize this. KEV and public PoC outweigh EPSS here.

Exploitation steps (defensive triage)

1. Recon and inventory: Identify all PaperCut NG/MF instances in your estate, including internet-facing and internal deployments. Confirm the running version against the affected ranges (prior to 24.1.10, 25.0.2–25.0.12, 26.0.2–26.0.4).
2. Exposure check: Determine which instances expose the admin/configuration interface (default port 9191) to untrusted networks. Restrict access to trusted management networks immediately.
3. Chain assessment: Evaluate whether any instance has exposure to CVE-2026-81578, which could supply the configuration-manipulation primitive. Treat the two as a combined attack path.
4. Log hunt: Review PaperCut application logs and JVM logs for configuration changes to database driver settings, especially to H2 or Derby driver class names, and for class-loading or reflection errors referencing unusual classes.
5. Process and network hunt: Look for unusual child processes spawned by the PaperCut Java process (cmd.exe, powershell.exe, /bin/bash, curl, wget) and unexpected outbound connections to unknown external IPs on high ports.
6. File system review: Check the PaperCut installation directory for unexpected .class or .csv files (used by Derby-based exploitation on 24.x–25.x), new web shells or scripts in the web root, and Meterpreter or RAT binaries written by the PaperCut service account.
7. Patch and verify: Apply the vendor's fixed release (24.1.10, 25.0.13, or 26.0.5) and verify the configuration baseline is restored. Re-scan to confirm the version and configuration state.
8. If compromise is suspected: Isolate the server, preserve logs and memory, and follow CISA's forensics triage guidance before rebuilding.

Indicators of compromise

• Unexpected changes to database driver names or connection parameters in PaperCut configuration files or the admin console.
• JVM or application log entries showing class loading or reflection of classes not normally used by PaperCut.
• New or modified JAR files, class files, or scripts appearing on the PaperCut server filesystem.
• Outbound network connections from the PaperCut server to unfamiliar hosts, especially after a configuration change.
• Administrative logins or configuration API calls from unusual source IPs or at unusual times.
• Child processes spawned by the PaperCut server process that are not part of normal operation.
• Alerts from EDR on reflective loading, dynamic class instantiation, or suspicious Java process behavior.
• References to the public PoC repositories (yora1928/PaperCut-CVE-2026-81578-82078, virologi-info/papercut-toolkit) in proxy, DNS, or endpoint telemetry.
• HTTP POST requests to PaperCut's ConfigEditor or external user lookup endpoints with unusual JDBC driver class names in parameters.

Mitigation and workarounds

PaperCut has released patched versions: 24.1.10, 25.0.13, and 26.0.5 for both PaperCut MF and PaperCut NG. Organizations should upgrade immediately, as the vendor's first emergency patch was bypassed and a second patch was required before the final maintenance releases were issued. CISA mandated federal agencies remediate by September 14, 2026 under BOD 26-04.

As interim mitigations:

• Restrict network access to the PaperCut admin interface (port 9191) to trusted IP ranges only.
• Implement access controls to limit who can modify system configuration parameters.
• Monitor configuration changes for unauthorized modifications to database driver settings.
• Consider network segmentation to isolate PaperCut servers from broader enterprise networks.
• Enforce least privilege on PaperCut administrative accounts and review who can modify system configuration parameters.
• Because the flaw chains with CVE-2026-81578, ensure both issues are remediated together.
• Follow CISA BOD 26-04 prioritization guidance and the associated forensics triage requirements. If mitigations are unavailable for a given deployment, consider discontinuing use of the affected service until a fix can be applied.

Community reactions

PaperCut issued an urgent security advisory on August 27, 2026, and subsequently released two emergency patches before shipping fully QA-tested maintenance releases, reflecting the severity and rapid exploitation pace. CISA added both CVE-2026-82078 and the companion CVE-2026-81578 to the KEV catalog on August 31, 2026, and issued a formal alert. Rapid7 published an ETR blog post and contributed the Metasploit module, noting the vendor's second emergency patch successfully remediated the exploit chain. GreyNoise documented an AI-orchestrated exploitation campaign that compromised 395–440 organizations across 48 countries, drawing significant media coverage from The Hacker News, BleepingComputer, SecurityWeek, and The Register. Security researchers on social media highlighted the novelty of AI agents being used to automate exploitation at scale, with some noting that 11 organizations were breached in as little as 26 seconds. The education sector — particularly U.S. and European schools and universities — was prominently targeted, generating widespread concern among IT administrators.

FAQ

Is CVE-2026-82078 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-31, confirming exploitation in the wild.

What is the CISA remediation due date? The due date is 2026-09-14. Federal agencies must remediate by then under BOD 26-04; all other organizations should treat it as an emergency patch.

Is this exploitable over the internet? The vulnerability is network reachable (AV:N) and PaperCut NG/MF typically listens on port 9191. Internet-facing instances are the highest-risk population, but internal deployments are also at risk because the flaw chains with CVE-2026-81578.

Which products and versions are affected? PaperCut NG and PaperCut MF: versions prior to 24.1.10, 25.0.2 through 25.0.12, and 26.0.2 through 26.0.4.

How do I verify remediation? Upgrade to 24.1.10, 25.0.13, or 26.0.5, then confirm the running version and review the configuration baseline for unauthorized changes to database driver settings. Re-scan the host to validate the version and configuration state.

Can this be chained with another vulnerability? Yes. CVE-2026-82078 can be chained with CVE-2026-81578, an authentication bypass that can supply the configuration-manipulation primitive. Remediate both together.

Is ransomware known to use this vulnerability? Known ransomware use is currently listed as unknown. However, attackers have been observed deploying Meterpreter payloads and remote access tools, stealing credentials, and using compromised PaperCut servers for lateral movement.

Related resources

• PaperCut urgent security advisory (27 Aug 2026)
• CISA KEV entry for CVE-2026-82078
• CISA BOD 26-04 Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD entry for CVE-2026-82078
• GitHub Advisory GHSA-mjg5-wj9r-9mfx
• Metasploit Module PR
• Rapid7 ETR Blog
• GreyNoise AI Campaign
• Arctic Wolf Analysis
• Wiz CVE page for CVE-2026-82078