CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability

Summary

CVE-2026-82078 is a critical unsafe reflection vulnerability (CWE-470) in PaperCut NG and PaperCut MF, the print-management platform used by an estimated 100 million users across more than 70,000 organizations worldwide. The flaw lets an attacker manipulate system configuration parameters so that PaperCut's database connection utilities load an attacker-controlled Java class by name, resulting in arbitrary Java bytecode execution under the security context of the PaperCut server process.

On its own, the flaw requires the ability to edit PaperCut's configuration. Chained with a companion authentication-bypass bug, it becomes pre-auth remote code execution — and CISA has now confirmed it is being exploited in the wild.

Vulnerability Details

How the Exploit Chain Works

1. CVE-2026-81578 lets an unauthenticated remote request reach administrative backend functions in the PaperCut web management interface before access-validation checks finish running.
2. With that access, an attacker edits a PaperCut configuration file to point the application's database connector at an attacker-controlled class name.
3. CVE-2026-82078 triggers when PaperCut's database utilities load that class via unsafe reflection, without validating it against an approved allowlist — handing the attacker arbitrary Java code execution with the privileges of the PaperCut server process.

Researchers at watchTowr, who helped PaperCut validate the fix, summarized it plainly: "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution."

CISA KEV Addition

CISA added both CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026, four days after PaperCut's initial disclosure. Under Binding Operational Directive 26-04, federal civilian agencies must apply vendor mitigations by September 14, 2026.

Active Exploitation: From Recon to Data Theft

Exploitation has moved fast and shifted in intent:

• Huntress first observed limited, targeted activity in two customer environments — base64-encoded reconnaissance commands (whoami, ver) and hex-encoded Java .class files used to bridge into OS command execution. Huntress reproduced the full attack chain from scratch against a clean, unpatched install.
• Threat-intel firm Defused reported honeypot activity beginning August 29 UTC showing a shift away from the RCE path documented in public write-ups: attackers are instead abusing the auth bypass to hijack PaperCut's external user-lookup function and dump database tables via Derby — going straight for data theft rather than deploying payloads.
• Shadowserver tracks more than 800 PaperCut MF/NG servers exposed directly to the internet, with no breakdown of how many are honeypots versus live, unpatched production systems.
• watchTowr has warned that internet-facing systems that were exposed in the days following disclosure should be treated as likely already compromised.

See our related coverage: PaperCut Releases Second Emergency Patch for Exploited Flaws and Recently Patched PaperCut Zero-Days Used in Data Theft Attacks.

Remediation

• Apply Emergency Patch Release 3 immediately for the 24, 25, and 26 branches — this supersedes both prior emergency releases; reinstall even if an earlier patch is already applied.
• Upgrade off version 23 or earlier rather than waiting on a legacy patch build.
• Restrict network access to the PaperCut Application Server to trusted/internal IP ranges; internet-facing instances are the highest-priority targets.
• Review server logs for indicators of compromise, including missing or truncated server.log files and entries such as ERROR No suitable driver found for jdbc:no:x or ERROR DatabaseUtils - Database error looking up cardID.
• Hunt for data-theft indicators specifically — unexpected calls to the external user-lookup function and unusual Derby database queries — not just RCE artifacts, given the observed shift in attacker tactics.

Why This Matters

PaperCut sits quietly on print servers across schools, universities, hospitals, and enterprises — infrastructure that rarely gets patch-priority until it's already under attack. That history isn't hypothetical: the 2023 authentication-bypass flaw CVE-2023-27350 was exploited by ransomware affiliates, including the Bl00dy gang, in attacks against the education sector. With a fast KEV listing, a growing pool of exposed servers, and attackers now favoring quiet data exfiltration over noisy payload deployment, treating "we already patched" as closed is not safe until Release 3 is confirmed installed.

Sources

• CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog
• BleepingComputer — Recently patched PaperCut zero-days used in data theft attacks
• The Hacker News — PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
• Rapid7 — PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Related Reading

• PaperCut Releases Second Emergency Patch for Exploited Flaws
• WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited