Skip to content
Back to search

CVE-2026-82078

CRITICAL
9.1 CISA KEVNVD

Summary

generated automatically from NVD data

PaperCut MF and PaperCut NG contain an unsafe dynamic class loading flaw (CWE-470) in their database connection utilities, which instantiate driver classes from configurable driver names without checking them against an allowlist. An attacker able to manipulate system configuration parameters could execute arbitrary Java bytecode present on the application classpath, running with the privileges of the PaperCut server process. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.1 and is listed in the CISA KEV catalog.

NVD description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-31. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2026-09-14

EPSS · FIRST.org

63.5%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

9.1
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Information

Published
28 août 2026
Updated
14 sept. 2026
Status
Analyzed
Source
eb41dac7-0af8-4f84-9f6d-0272772514f4

Affected products

papercut papercut mf
Versions : 24.1.9, 25.0.12, 26.0.4
papercut papercut ng
Versions : 24.1.9, 25.0.12, 26.0.4

Weaknesses (CWE)

CWE-470

References (3)

Similar CVEs

Other vulnerabilities of type CWE-470

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring