CVE-2026-82078

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 10/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

CISA Known Exploited Vulnerability

Vendor / Product PaperCut — NG/MF

Date Added 2026-08-31

Remediation Due 2026-09-14

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078

Weakness Classification (1)

CWE-470

Affected Software (6)

Vendor	Product	Version
papercut	papercut_mf	< 24.1.9
papercut	papercut_mf	25.0.2 – 25.0.12
papercut	papercut_mf	26.0.2 – 26.0.4
papercut	papercut_ng	< 24.1.9
papercut	papercut_ng	25.0.2 – 25.0.12
papercut	papercut_ng	26.0.2 – 26.0.4