CVE-2026-82078
published 2026-08-28CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database…
PriorityP191critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-14
Exploited in the wild
EPSS
63.53%
99.2th percentile
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| papercut | papercut_mf | < 24.1.9 | 24.1.9 |
| papercut | papercut_mf | >= 25.0.2 < 25.0.12 | 25.0.12 |
| papercut | papercut_mf | >= 26.0.2 < 26.0.4 | 26.0.4 |
| papercut | papercut_mf_ng | < 24.1.10 | 24.1.10 |
| papercut | papercut_mf_ng | >= 25.0.0 < 25.0.13 | 25.0.13 |
| papercut | papercut_mf_ng | >= 26.0.0 < 26.0.5 | 26.0.5 |
| papercut | papercut_ng | < 24.1.9 | 24.1.9 |
| papercut | papercut_ng | >= 25.0.2 < 25.0.12 | 25.0.12 |
| papercut | papercut_ng | >= 26.0.2 < 26.0.4 | 26.0.4 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.4CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.
ghsa_unreviewed·2026-08-28
CVE-2026-82078 [CRITICAL] CWE-470 An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
VulnCheck
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
vulncheck·2026·CVSS 9.4
CVE-2026-82078 [CRITICAL] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Affected: PaperCut PaperCut NG/MF
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previ
CISA
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
cisa·2026-08-31·CVSS 9.8
CVE-2026-81578 [CRITICAL] CWE-306 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Vulnerability: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Affected: PaperCut NG/MF
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and en
CISA
PaperCut NG/MF Unsafe Reflection Vulnerability
cisa·2026-08-31·CVSS 9.8
CVE-2026-82078 [CRITICAL] CWE-470 PaperCut NG/MF Unsafe Reflection Vulnerability
Vulnerability: PaperCut NG/MF Unsafe Reflection Vulnerability
Affected: PaperCut NG/MF
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are res
Elastic
Suspicious Java Class File Created in PaperCut Server Library
elastic_rules·CVSS 8.8
CVE-2026-82078 [HIGH] Suspicious Java Class File Created in PaperCut Server Library
Suspicious Java Class File Created in PaperCut Server Library
Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
inside the PaperCut JVM / Application Server process.
Query:
file where host.os.type in ("windows", "linux", "macos") and
event.action in ("creation", "overwrite") and
file.extension : "class" and
file.path : (
"?:\\Program Files\\PaperCut*\\server\\lib\\*",
"?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
"/opt/papercut/server/lib/*",
"/usr/local/papercut/server/lib/*",
"
Elastic
Suspicious Child Process of PaperCut Server Component
elastic_rules·CVSS 8.8
CVE-2026-82078 [HIGH] Suspicious Child Process of PaperCut Server Component
Suspicious Child Process of PaperCut Server Component
Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
unexpected Windows utilities such as charmap.e
Recorded Future
September 2026 CVE Landscape
blogs_recorded_future·2026-10-13·CVSS 9.8
CVE-2026-88771 [CRITICAL] September 2026 CVE Landscape
## September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and m
Hackernews
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
blogs_hackernews·2026-10-05·CVSS 7.5
CVE-2026-88779 [HIGH] ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.
There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others are still getting in because the basics gave way first.
Here’s what mattered this week.
## ⚡ Threat of the Week
Citrix Warns of Ne
Hackernews
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
blogs_hackernews·2026-09-14
CVE-2026-85046 ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.
The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.
Here’s what mattered this week.
## ⚡ Threat of the Week
OpenAI Agents Behind May 2026 Attack o
Hackernews
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
blogs_hackernews·2026-09-11·CVSS 9.8
CVE-2026-81578 [CRITICAL] PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation.
The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download.
"These are Regular Maintenance Releases (MR) that have gone through complete QA testing," it said. "They contain all of the security fixes issued in Emergency Patch Releases 1, 2 and 3, plus additional sec
Rapid7
Metasploit Wrap Up: This One Goes to Sixteen!
blogs_rapid7·2026-09-11·CVSS 8.4
CVE-2025-66516 [HIGH] Metasploit Wrap Up: This One Goes to Sixteen!
## This One Goes to Sixteen!
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
## New module content (16)
## Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read
Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon
Type: Auxiliary
Pull request: #21739 contributed by kmkz
Path: scanner/http/elasticsearch_tika_xfa_xxe
CVE reference: CVE-2025-66516
Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed thro
Hackernews
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
blogs_hackernews·2026-09-10·CVSS 9.8
CVE-2026-81578 [CRITICAL] PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances.
According to independent reports from Blackpoint Cyber and GreyNoise , the activity originates from " 45.142.193[.]132 ," an IP address that has been linked to unauthorized port scanning and brute-force attack attempts in recent weeks. It's worth noting the same IP address was also flagged by Arctic Wolf in connection with
Greynoiseio
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
blogs_greynoiseio·2026-09-09·CVSS 9.8
CVE-2026-81578 [CRITICAL] Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of 45.142.193.132 since early July 2026 due to its use for attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.
On 31 August 2026, a likely Russian-speaking malicious cyber actor (MCA) used 45.142.193.132 and artificial intelligence (AI) to develop, test, and use exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). PaperCut is print management software that enables organizat
Hackernews
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
blogs_hackernews·2026-09-05·CVSS 9.8
CVE-2026-81578 [CRITICAL] Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.
The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as create privileged accounts.
"Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-rela
Hackernews
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
blogs_hackernews·2026-08-31
CVE-2026-81578 ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
The boring parts caused most of the trouble.
A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional.
Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look.
Here is the week...
## ⚡ Threat of the
Checkpoint
31th August – Threat Intelligence Report
blogs_checkpoint·2026-08-31
CVE-2026-81578 31th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 31th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, vehicle registration numbers, and information collected through car park, lounge, fast-track, and W
Hackernews
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
blogs_hackernews·2026-08-28·CVSS 8.8
CVE-2026-82078 [HIGH] Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening.
"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said .
Specifically, an attacker can leverage an unauthenticated request to make changes to the server
Rapid7
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
blogs_rapid7·2026-08-28·CVSS 9.8
CVE-2026-81578 [CRITICAL] PaperCut NG/MF Critical Zero-Day Exploited in the Wild
## Overview
On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the initial time of disclosure, the vulnerability had not been assigned a CVE identifier, and PaperCut had not publicly disclosed a CVSS score, vulnerability class, authentication requirements, or the technical details of the exploit path. However on August 28, the vendor assigned CVE-2026-81578 and CVE-2026-82078 for the two vulnerabilities that make up the exploit chain.
CVE ID
Description
CWE
CVSSv4
CVE-2026-81578
Authentication Bypass
CWE-306 Missing authentication for critical function.
Huntress
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
blogs_huntress·2026-08-28·CVSS 8.8
CVE-2026-81578 [HIGH] PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
Acknowledgements : Special thanks to Tanner Filip, Jai Minton, Max Rogers, Ben Nahorney, Lindsey Welch, Aaron Deal, Dray Agha, Lindon Wass, Michael Elford, and Craig Sweeney for their contributions to this investigation and writeup.
Update: 8/28/26 @ 2:45PM ET
PaperCut has released a second emergency patch, referred to as Release 2, for PaperCut NG and PaperCut MF. If you already installed the original emergency patch, PaperCut recommends installing Release 2 as well. Organizations should follow PaperCut's urgent security advisory for the latest supported builds and installation guidance.
PaperCut has also assigned two CVEs to the vulnerabilities involved in this attack chain:
CVE-2026-81578 is an improper access control vulnerability in the web management interface that can allow an un
2026-08-28
Published
2026-08-31
Added to CISA KEV
Exploited in the wild