CVE-2026-82078

CRITICALCVSS 9.1Known Exploited

CISA Known Exploited Vulnerability

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078

Remediation deadline: September 14, 2026

Description

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

Timeline

Published:August 28th, 2026 4:18 PM

Last modified:September 1st, 2026 4:18 AM

Added to KEV:August 31st, 2026

CVSS Scoring

CVSS v3: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

papercut

Products

papercut_mfpapercut_ng

Weaknesses (CWE)

CWE-470

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute