CVE-2026-82078: PaperCut MF/NG unsafe dynamic class loading enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 score is 9.4 and the flaw is in CISA KEV with known exploitation, so it should be patched immediately.

What it is

PaperCut MF and NG instantiate database driver classes from configurable driver names without validating them against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can therefore force the server to load and execute arbitrary Java bytecode already present on the application classpath. The flaw is rated critical (CVSS 4.0 9.4) and has been added to CISA KEV, so it warrants urgent attention.

Impact

An attacker gains arbitrary Java code execution in the security context of the PaperCut server process, with high impact to confidentiality, integrity and availability of the application and connected systems. Because the code runs as the server process, it can be used to read data, alter configuration or pivot further into the host.

Attack surface

The vulnerability is network reachable (AV:N) with no user interaction (UI:N) and low attack complexity, but requires high privileges (PR:H) because the attacker must be able to manipulate system configuration parameters such as the database driver name. It is not an unauthenticated remote path; it depends on access sufficient to change configuration.

Exploitation

CVE-2026-82078 is listed in CISA KEV with a due date of 2026-09-14, indicating known exploitation, though CISA records no known ransomware campaign use. EPSS is 0.03574 (88.8th percentile), and references include a Metasploit framework pull request, suggesting public tooling exists.

What to do

• Apply the vendor patch from the PaperCut security bulletin (27 Aug 2026) as the first action, and follow CISA BOD 26-04 guidance for any cloud-hosted instances.
• Restrict and audit who can modify PaperCut system configuration, especially database driver and connection settings, enforcing least privilege.
• Where patching is not immediately possible, limit network exposure of PaperCut MF/NG servers and discontinue use if mitigations are unavailable per CISA guidance.
• Monitor for unexpected database driver class names or configuration changes and revert unauthorized modifications.
• Review the classpath for attacker-writable or unnecessary JARs that could supply malicious driver classes.

Detection

• Alert on changes to PaperCut database driver or connection configuration parameters outside approved change windows.
• Hunt for unexpected or non-standard database driver class names in PaperCut configuration and logs.
• Monitor PaperCut server process behavior for loading of unusual classes or JARs from the application classpath.
• Correlate PaperCut configuration changes with subsequent process execution or outbound network activity from the server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.