PaperCut NG/MF Unsafe Class-Loading RCE
PaperCut NG/MF (CVSS 9.4 Critical): unsafe dynamic class-loading enables unauthenticated RCE. Actively exploited; apply Emergency Patch Release 2 immediately.
- Vendor
- PaperCut Software
- Product
- PaperCut NG and PaperCut MF (versions 24, 25, 26)
- CVSS
- 9.1
- EPSS (exploit probability)
- 63.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-82078 being exploited?
Yes. CISA added CVE-2026-82078 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 63.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-82078 timeline
- Added to EU KEV (ENISA)-1d (before NVD)
- Published to NVD
- First 0dayNews coverage+1d
- Added to CISA KEV+3d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-82078 is a critical flaw in PaperCut NG and PaperCut MF (CVSS 9.4) affecting versions 24, 25, and 26. The application loads database driver classes based on configurable driver names without validating them against an approved allowlist. An attacker who has bypassed authentication via CVE-2026-81578 can reconfigure external database settings, loading arbitrary Java classes and ultimately achieving remote code execution on the server.
PaperCut has not disclosed the full technical class of this vulnerability; the CVSS 9.4 rating reflects the combination of unauthenticated precondition (via CVE-2026-81578) and full RCE outcome. Per Rapid7’s technical report, the attack chain was reproducible against Emergency Patch Release 1.
Active exploitation was confirmed in the wild before the initial patch shipped. PaperCut’s Emergency Patch Release 2 includes additional hardening to close bypass paths identified by Huntress and watchTowr researchers.
Patch: Apply Emergency Patch Release 2 for versions 24, 25, or 26. Version 23 and older users should upgrade to a supported release. Patch links in PaperCut’s updated bulletin.
Other PaperCut Software CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-81578 PaperCut NG/MF Authentication Bypasswrite-up | [ CRITICAL ] | 9.8 | 85.6% |
