CVE-2026-82078
published 2026-08-28CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database…
PriorityP183critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-14
Exploited in the wild
EPSS
1.69%
75.6th percentile
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| papercut | papercut_mf | < 24.1.9 | 24.1.9 |
| papercut | papercut_mf | >= 25.0.2 < 25.0.12 | 25.0.12 |
| papercut | papercut_mf | >= 26.0.2 < 26.0.4 | 26.0.4 |
| papercut | papercut_mf_ng | < 24.1.10, 25.0.13, 26.0.5 | 24.1.10, 25.0.13, 26.0.5 |
| papercut | papercut_ng | < 24.1.9 | 24.1.9 |
| papercut | papercut_ng | >= 25.0.2 < 25.0.12 | 25.0.12 |
| papercut | papercut_ng | >= 26.0.2 < 26.0.4 | 26.0.4 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.4CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.
ghsa_unreviewed·2026-08-28
CVE-2026-82078 [CRITICAL] CWE-470 An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
VulnCheck
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
vulncheck·2026·CVSS 9.4
CVE-2026-82078 [CRITICAL] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Affected: PaperCut PaperCut NG/MF
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previ
CISA
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
cisa·2026-08-31·CVSS 9.8
CVE-2026-81578 [CRITICAL] CWE-306 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Vulnerability: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Affected: PaperCut NG/MF
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and en
CISA
PaperCut NG/MF Unsafe Reflection Vulnerability
cisa·2026-08-31·CVSS 9.8
CVE-2026-82078 [CRITICAL] CWE-470 PaperCut NG/MF Unsafe Reflection Vulnerability
Vulnerability: PaperCut NG/MF Unsafe Reflection Vulnerability
Affected: PaperCut NG/MF
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are res
Elastic
Suspicious Java Class File Created in PaperCut Server Library
elastic_rules·CVSS 8.8
CVE-2026-82078 [HIGH] Suspicious Java Class File Created in PaperCut Server Library
Suspicious Java Class File Created in PaperCut Server Library
Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
inside the PaperCut JVM / Application Server process.
Query:
file where host.os.type in ("windows", "linux", "macos") and
event.action in ("creation", "overwrite") and
file.extension : "class" and
file.path : (
"?:\\Program Files\\PaperCut*\\server\\lib\\*",
"?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
"/opt/papercut/server/lib/*",
"/usr/local/papercut/server/lib/*",
"
Elastic
Suspicious Child Process of PaperCut Server Component
elastic_rules·CVSS 8.8
CVE-2026-82078 [HIGH] Suspicious Child Process of PaperCut Server Component
Suspicious Child Process of PaperCut Server Component
Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
unexpected Windows utilities such as charmap.e
Greynoiseio
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
blogs_greynoiseio·2026-09-09·CVSS 9.8
CVE-2026-81578 [CRITICAL] Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of 45.142.193.132 since early July 2026 due to its use for attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.
On 31 August 2026, a likely Russian-speaking malicious cyber actor (MCA) used 45.142.193.132 and artificial intelligence (AI) to develop, test, and use exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). PaperCut is print management software that enables organizat
Hackernews
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
blogs_hackernews·2026-09-05·CVSS 9.8
CVE-2026-81578 [CRITICAL] Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.
The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as create privileged accounts.
"Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-rela
Hackernews
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
blogs_hackernews·2026-08-31
CVE-2026-81578 ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
The boring parts caused most of the trouble.
A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional.
Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look.
Here is the week...
## ⚡ Threat of the
Checkpoint
31th August – Threat Intelligence Report
blogs_checkpoint·2026-08-31
CVE-2026-81578 31th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 31th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, vehicle registration numbers, and information collected through car park, lounge, fast-track, and W
Hackernews
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
blogs_hackernews·2026-08-28·CVSS 8.8
CVE-2026-82078 [HIGH] Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening.
"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said .
Specifically, an attacker can leverage an unauthenticated request to make changes to the server
Rapid7
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
blogs_rapid7·2026-08-28·CVSS 9.8
CVE-2026-81578 [CRITICAL] PaperCut NG/MF Critical Zero-Day Exploited in the Wild
## Overview
On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the initial time of disclosure, the vulnerability had not been assigned a CVE identifier, and PaperCut had not publicly disclosed a CVSS score, vulnerability class, authentication requirements, or the technical details of the exploit path. However on August 28, the vendor assigned CVE-2026-81578 and CVE-2026-82078 for the two vulnerabilities that make up the exploit chain.
CVE ID
Description
CWE
CVSSv4
CVE-2026-81578
Authentication Bypass
CWE-306 Missing authentication for critical function.
Huntress
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
blogs_huntress·2026-08-28·CVSS 8.8
CVE-2026-81578 [HIGH] PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
Acknowledgements : Special thanks to Tanner Filip, Jai Minton, Max Rogers, Ben Nahorney, Lindsey Welch, Aaron Deal, Dray Agha, Lindon Wass, Michael Elford, and Craig Sweeney for their contributions to this investigation and writeup.
Update: 8/28/26 @ 2:45PM ET
PaperCut has released a second emergency patch, referred to as Release 2, for PaperCut NG and PaperCut MF. If you already installed the original emergency patch, PaperCut recommends installing Release 2 as well. Organizations should follow PaperCut's urgent security advisory for the latest supported builds and installation guidance.
PaperCut has also assigned two CVEs to the vulnerabilities involved in this attack chain:
CVE-2026-81578 is an improper access control vulnerability in the web management interface that can allow an un
2026-08-28
Published
2026-08-31
Added to CISA KEV
Exploited in the wild