A critical vulnerability, CVE-2026-82078, affecting PaperCut NG and MF print management software, was exploited in the wild at least one day before its public disclosure on August 28, 2026. The flaw, described as an unsafe reflection vulnerability, has a CVSS score of 9.1 and allows for remote code execution.
The vulnerability stems from the application's database connection utilities, which instantiate database driver classes based on configurable driver names without proper validation against an allowlist. This oversight enables an attacker who can manipulate system configuration parameters to execute arbitrary Java bytecode residing on the application's classpath, operating under the security context of the PaperCut server process.
Evidence of exploitation was first noted on August 27, 2026, when the vulnerability was added to the European Union Agency for Cybersecurity (ENISA) EUVD list of exploited vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added it to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026, with a federal fix deadline of September 14, 2026.
PaperCut confirmed the issue and released an urgent security advisory on August 27, 2026, providing patches for the affected software. This advisory also addressed a related authentication bypass vulnerability, CVE-2026-81578, which, when chained with CVE-2026-82078, could lead to credential theft and privileged access.
Reports from security researchers indicate that threat actors have been actively exploiting these vulnerabilities, particularly targeting the education sector in the U.S. and Europe. Attackers have leveraged the flaws to conduct command execution, reconnaissance, and steal credentials.
PaperCut has urged all customers to install the latest patches, even if they had applied earlier fixes, as initial remediations were found to be bypassable. The company also recommends implementing network access controls as a precautionary measure to mitigate potential risks.
