8 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-82078 and CVE-2026-81578 are critical and high-severity vulnerabilities affecting PaperCut NG and PaperCut MF.
CVE-2026-82078 is an unsafe dynamic class loading vulnerability that may allow an attacker who can manipulate system configuration parameters to execute arbitrary Java bytecode under the security context of the PaperCut server process.
CVE-2026-81578 is an improper access control vulnerability that may allow an unauthenticated remote attacker to trigger administrative backend actions before access validation is completed, potentially enabling unauthorized modification of system configurations.
PaperCut has confirmed customer incidents involving active exploitation. The vendor has released Emergency Patch Release 2 and recommends that all customers install it, including those that previously applied the original emergency patch.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Unsafe Dynamic Class Loading and Authentication Bypass in PaperCut NG and PaperCut MF
Identifier: CVE-2026-82078, CVE-2026-81578
PoC or Exploitation: Confirmed actively exploited in the wild. PaperCut states it is aware of confirmed customer incidents.
CVSS Score: 9.4, Critical, CVSS v4.0 for CVE-2026-82078 . 8.8, High, CVSS v4.0 for CVE-2026-81578
Update / Patch:
PaperCut has released Emergency Patch Release 2, which supersedes and adds hardening beyond the original emergency patch. All customers should install Release 2 even if the original emergency patch was already applied.
Affected versions include:
- All versions of PaperCut NG
- All versions of PaperCut MF
Fixed versions include:
Emergency Patch Release 2, available for PaperCut NG/MF v24, v25, and v26
Site Servers and secondary or print servers must also be updated to a patched version.
Customers using an external database for Card and ID number lookups, a rarely used feature that is disabled by default, must add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server after patching.
PaperCut Security Bulletin:
Description:
CVE-2026-82078 is an unsafe dynamic class loading vulnerability in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can use this flaw to execute arbitrary Java bytecode under the security context of the PaperCut server process.
CVE-2026-81578 is an improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete. This allows an unauthenticated remote attacker to modify certain system configurations.
CVE-2026-81578 is an improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete. This allows an unauthenticated remote attacker to modify certain system configurations.
Mitigation Recommendation:
Apply Emergency Patch Release 2 to all PaperCut NG and PaperCut MF Application Servers immediately. Install Release 2 even if the original emergency patch was already applied.
If immediate patching is not possible, restrict web access to the PaperCut Application Server to trusted internal IP addresses only.
Review server.log for the vendor-published error signatures, and separately check for missing, truncated, or unexpectedly deleted server.log files, which may indicate attempted evidence destruction.
Review IDS, EDR, and network-monitoring alerts for suspicious post-exploitation activity involving pc-app.exe.
