CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
CSIRTS triage
- What
- Unsafe reflection vulnerability allows attackers to execute arbitrary Java bytecode under the server process context.
- Who is affected
- All deployments of PaperCut NG/MF are affected, especially when chained with CVE-2026-81578.
- Urgency
- Critical; actively exploited and chains with CVE-2026-81578 to enable full code execution.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch PaperCut NG/MF
Get an email when a new PaperCut NG/MF advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-82078
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-82078Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 58% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-82078 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedPaperCut security advisory (AV26-858) – Update 2cccs
- criticalexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- unknownexploitedPaperCut Multiple Vulnerabilitieshkcert
- criticalexploitedCVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of P…nvd
- unknownexploitedNCSC-2026-0334 [1.00] [M/H] Vulnerabilities patched in PaperCut MF and PaperCut NG from PaperCutncsc-nl
- unknownexploitedMultiple vulnerabilities in Papercut (August 28, 2026)cert-fr-avis
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability2026-09-02
- criticalCVE-2026-49869: Kestra OSS OS Command Injection Vulnerability2026-09-02
- criticalCVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability2026-09-02
- criticalCVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability2026-09-02
- criticalCVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability2026-09-02