CVE-2026-82078 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-28

Added to CISA KEV: 2026-08-31 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review PaperCut application and web server logs for unexpected configuration changes to database driver parameters, anomalous child processes spawned by the PaperCut/Java process, unexpected outbound connections, and new/modified files on the server filesystem.
Immediately upgrade to PaperCut MF/NG 24.1.10, 25.0.13, 26.0.5 (or later) per PaperCut's 27 Aug 2026 security advisory. Note this CVE is often chained with CVE-2026-81578 — ensure both are remediated.
Remove the PaperCut server and its admin/user web interfaces from direct internet exposure; restrict access via VPN, firewall allowlists, and network segmentation. Restrict admin console (default port 9191/9192) to trusted internal IPs only.
Monitor for exploitation attempts against PaperCut endpoints, deploy IDS/IPS signatures for the known exploit chain, rotate any credentials/secrets that may have been exposed on compromised servers, and treat any confirmed exploitation as full server compromise requiring rebuild.
PATCH PRIORITY: EMERGENCY — patch within 24–48 hours given KEV status, public Metasploit exploit, and total technical impact.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-82078 is a critical security vulnerability involving unsafe dynamic class loading within the database connection utilities of PaperCut MF and PaperCut NG. The application incorrectly instantiates database driver classes based on configurable names without validating them against an allowlist of approved drivers. This flaw is significant because, when chained with other vulnerabilities (such as CVE-2026-81578), it allows remote attackers to achieve pre-authentication remote code execution, posing a severe risk to the integrity and confidentiality of the affected application servers ^[2]^[6].

Exploitation

Active Exploitation: The vulnerability has been identified as being actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog ^[3]^[4].
Threat Actors: While specific ransomware campaigns or actors were not detailed, the active exploitation indicates a high level of interest from malicious entities targeting vulnerable servers ^[1].
PoC/Exploit Tools: Research indicates that the vulnerability can be chained with CVE-2026-81578 to achieve remote code execution, suggesting the existence of functional exploit chains in the wild ^[1]^[7].
Prerequisites: The exploit can be initiated remotely if attackers can modify configurations via the network; otherwise, it may require local access or specific permissions to alter configuration files ^[3].

Affected Products & Patches

Affected Versions: All versions of PaperCut MF and PaperCut NG prior to 25.0.3 are confirmed to be vulnerable ^[1]^[5].
Patches: PaperCut Software released security maintenance releases (version 25.0.3 and later) in late August/early September 2026 to resolve the issue, superseding previous emergency patches ^[4].
Mitigation: Organizations should prioritize upgrading to the patched versions immediately; no alternative workarounds have been recommended as sufficient for protection ^[5].

Impact

Access/Capability: Successful exploitation permits unauthorized attackers to execute arbitrary code on the application server, potentially gaining full control over the host system ^[1].
Business Risk: Internet-facing deployments are at extreme risk, as they are exposed to remote exploitation attempts, which could lead to data breaches, ransomware deployment, or complete service disruption ^[1]^[3].

Sources

PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE ...
PaperCut released an Urgent Security Advisory to address two actively exploited vulnerabilities, tracked as CVE-2026-82078 & CVE-2026-81578, impacting all versions of PaperCut NG and PaperCut MF. When chained together, these vulnerabilities can enable pre-authentication remote code execution in the…
NVD-CVE-2026-82078
CVE-2026-82078 Detail Description An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved driv…
CVE-2026-82078 - Vulnerability Details - OpenCVE
The vulnerability is listed in the CISA KEV catalog, confirming known exploitation potential. The likely attack vector is remote if configuration changes can be made over the network; otherwise, local attackers with editor rights to the configuration files can abuse it. Generated by OpenCVE AI on Au…
URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
URGENT Security Advisory Status 10 Sep 2026, 2:00pm (AEST): Security maintenance releases published. These replace all emergency patches. Download links below. Read the Behind the Scenes blog post for the backstory. PaperCut Software security response team is investigating active exploitation of a v…
Warning: Critical and High vulnerability in PaperCut, Patch ...
Affected software: PaperCut MF < 25.0.3; PaperCut NG < 25.0.3. Type: CWE-470 Use of Externally-Controlled input to select classes or code (' ...

🔴 CVE-2026-82078