CVE-2026-82078: PaperCut NG/MF Unsafe Reflection RCE (KEV)

CVE-2026-82078 is an unsafe dynamic class loading flaw in PaperCut NG/MF's database connection utilities that, chained with a companion authentication-bypass flaw (CVE-2026-81578), lets an unauthenticated remote attacker execute arbitrary Java bytecode on the PaperCut Application Server, and PaperCut's security team has confirmed real customer incidents from active exploitation.

CVE-2026-82078 is an unsafe reflection vulnerability (CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF. NVD's Analyzed description states that the application "instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers," so that if "an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process" (NVD).

NVD lists a Primary CVSS v3.1 score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); a CNA also submitted a Secondary CVSS v4.0 score of 9.4 (NVD).

PaperCut's own security bulletin (published 27 August 2026, continually updated) states its "security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF" and that it is "aware of confirmed customer incidents." The bulletin lists CVE-2026-82078 ("Unsafe Dynamic Class Loading in Database Connector," mitigated by the Emergency Patch) alongside the companion flaw CVE-2026-81578 ("Authentication Bypass" — an improper access control issue in the web management interface that lets unauthenticated requests trigger administrative backend actions before access checks complete); the two are used together in the observed attack chain. The bulletin also lists concrete indicators of compromise, including the string jdbc:derby:memory:pwn;create=true and random 5-character .class/.cmd files written under the PaperCut install directory (PaperCut Security Bulletin).

CISA added CVE-2026-82078 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-31, with a required-action due date of 2026-09-14; the KEV entry for this CVE explicitly notes "this vulnerability can be chained with CVE-2026-81578." The catalog does not record known ransomware campaign use (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.6089 (99.150th percentile), consistent with the vendor's own account of confirmed customer compromises (FIRST EPSS).

Any PaperCut NG/MF Application Server reachable from the internet on an affected build should be upgraded to the current Maintenance Release (24.1.10, 25.0.13 or 26.0.5) immediately; until patched, PaperCut's advisory treats restricting web access to the Application Server to trusted addresses as essential, and recommends checking server logs for the published indicators of compromise.

• Unsafe dynamic class loading in PaperCut NG/MF's database connection utilities lets an attacker who can manipulate system configuration parameters execute arbitrary Java bytecode under the PaperCut server process. — NVD
• NVD Primary CVSS v3.1 base score is 9.1, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H; a CNA Secondary CVSS v4.0 score of 9.4 is also on record. — NVD
• PaperCut confirms active exploitation and confirmed customer incidents; CVE-2026-82078 is chained with the companion authentication-bypass CVE-2026-81578; fixed in Emergency Patches 24.1.9/25.0.12/26.0.4, superseded by Maintenance Releases 24.1.10/25.0.13/26.0.5. — PaperCut Security Bulletin
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-31, required-action due date 2026-09-14, noted as chainable with CVE-2026-81578. — CISA KEV
• EPSS score is 0.6089 (99.150th percentile) as of 2026-10-28. — FIRST EPSS