CVE-2026-82078

What is PaperCut NG/MF?

PaperCut NG and MF are print-management servers deployed in tens of thousands of organizations — schools, universities, hospitals, and enterprises — to meter and control printing fleets. The Application Server is a Java web application that typically runs with broad privileges and is frequently internet-exposed for remote-print scenarios. PaperCut has serious exploitation history: the 2023 flaws CVE-2023-27350/27351 were mass-exploited by Cl0p and Bl00dy ransomware and by state-linked actors.

Overview

CVE-2026-82078 is an unsafe-reflection flaw (CWE-470) in PaperCut NG/MF: an attacker who can manipulate system configuration parameters can load arbitrary Java classes and execute bytecode in the Application Server's security context. On its own that requires admin-level config access — but in the wild it was chained with CVE-2026-81578, an unauthenticated access-control bypass, turning the pair into pre-auth remote code execution. Both were zero-days exploited before PaperCut's 2026-08-27 urgent advisory, and both entered the CISA KEV catalog on 2026-08-31.

Affected Versions

PaperCut shipped three emergency patches in quick succession (late August through ~2026-09-01) after watchTowr and Huntress researchers found bypasses of the first fix — apply the latest build in PaperCut's bulletin, not merely the first patch. Exact build numbers are listed in the vendor advisory.

Technical Details

PaperCut's database connection utilities instantiate database driver classes from a configurable driver-class name without validating it against an allowlist. An attacker able to change that configuration parameter can point it at any class on the application classpath and have the server instantiate it — classic unsafe reflection — executing arbitrary Java bytecode as the PaperCut server process (typically SYSTEM/root). The CVSS vector's PR:H reflects the standalone requirement for config access; the chained real-world attack path (via CVE-2026-81578) needs no authentication at all. Press-reported vendor scoring (9.4) differs slightly from the NVD 9.1 used here.

Discovery

A zero-day — in-the-wild exploitation preceded disclosure, and PaperCut published its urgent bulletin on 2026-08-27 while the attacks were under investigation. watchTowr and Huntress researchers collaborated on identifying patch-bypass techniques that drove the follow-up emergency patches.

Exploitation Context

Huntress observed exploitation in two customer environments: reconnaissance commands and hex-encoded Java payloads bridging the PaperCut application and the underlying OS (no malware persistence observed in those cases). Threat-intel firm Defused saw honeypot exploitation from 2026-08-29 UTC with a data-theft focus — hijacking PaperCut's external user-lookup mechanism and dumping database tables via the embedded Derby database. No actor has been named, but PaperCut flaws were previously favored by Cl0p, Bl00dy, and state-backed groups. 800+ PaperCut NG/MF servers are internet-exposed per Shadowserver.

Remediation

1. Apply PaperCut's latest emergency patch (Emergency Patch Release 2 or newer) for v24/v25/v26; older versions must upgrade to a patched major release. Federal deadline: 2026-09-14.
2. Verify you're on the final patch, not the first — the initial fix was bypassed; re-check the 27-Aug bulletin for the current build.
3. Restrict web-interface exposure now: firewall the admin interface (default port 9191/9192) to trusted management networks; internet exposure of the Application Server is the primary risk factor.
4. Hunt for compromise since late August 2026: unexpected config changes (especially database driver and external user-lookup settings), hex-encoded Java artifacts, Derby database access anomalies, and new admin sessions.
5. If configuration tampering is found, treat stored data as breached — PaperCut databases hold user directories and print metadata — and rotate the server's service-account credentials.