CVE-2026-82078

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-82078 9.4

PaperCut · NG/MF · Added 2026-08-31 · Published 2026-08-28

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityPaperCut NG/MF Unsafe Reflection Vulnerability

VendorPaperCut

ProductNG/MF

Date added2026-08-31

Due date2026-09-14

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-470

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Descriptions

KEV: PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

NVD: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-31 18:02 UTC

Searches8

Component defaultunknown

Sources https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
https://www.huntress.com/blog/papercut-actively-exploited
https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
https://threatprotect.qualys.com/2026/08/31/papercut-ng-mf-zero-day-vulnerability-exploited-in-the-attacks-cve-2026-82078-cve-2026-81578/
https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt PaperCut server.log for DatabaseUtils ERRORS referencing VALUES CAST, Derby boot messages with unusual memory: database names, and unexpected .class files created under server/lib during the class-loading phase.

Research details

ComponentDatabase connection utilities (unsafe dynamic JDBC driver class loading in user-lookup.db-driver config)

PreconditionsRequires prior exploitation of CVE-2026-81578 to modify PaperCut system configuration parameters (user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql, user-lookup.enabled). Attacker must chain with the authentication bypass to reconfigure external DB lookup settings, then trigger a user/card search that invokes the forged JDBC connection. Only exploitable on unpatched PaperCut NG/MF versions. agent

DeliveryTriggered via forged user/card search request that activates the attacker-configured external database lookup

Public PoCyes

PoC URLs https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
https://www.huntress.com/blog/papercut-actively-exploited Third-party repos; verify before use.

Advisoryhttps://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

Exploit notesSecond link in the pre-auth RCE chain. After CVE-2026-81578 bypasses auth and reconfigures user-lookup.db-driver to a malicious class name, the application instantiates the attacker-controlled class via reflection without allowlist validation. The attack leverages Apache Derby foreignViews to open an H2 JDBC URL with an INIT statement that creates a Nashorn JavaScript trigger for OS command execution. Huntress and Rapid7 both confirmed the full chain works.

SummaryPaperCut NG/MF contains an unsafe dynamic class loading vulnerability in its database connection utilities (CVE-2026-82078) that enables arbitrary Java bytecode execution when chained with the authentication bypass in CVE-2026-81578. The vulnerability has a CVSSv4 score of 9.4 (Critical) and is actively exploited in the wild. Emergency Patch Release 2 addresses both vulnerabilities for PaperCut NG/MF versions 24, 25, and 26.

Tia coverage

First reported2026-08-27

First exploit report2026-08-28

Exploit report → KEV3 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-pa greynoise-agents-gone-wild-an-ai-orchestrated-global-campaign-ag

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.