InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed two flaws in PaperCut NG and PaperCut MF in its Known Exploited Vulnerabilities (KEV) Catalog. They warn that hackers are using these flaws in real attacks.
The flaws with PaperCut, known as CVE-2026-81578 and CVE-2026-82078, can be linked together. This lets attackers who are not signed in change server settings and run harmful Java code using the PaperCut server’s permissions.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
CISA Warns of PaperCut NG/MF Flaws
PaperCut NG and PaperCut MF are popular tools for managing printers. They are used by schools, businesses, government offices, and service providers. Their main job is to handle printers, user logins, limits, and document processes. If a PaperCut server is hacked, it can give attackers a good way to reach internal networks.
CVE-2026-81578 is a flaw where authentication is missing in an important function of PaperCut NG/MF. This flaw lets a remote attacker change specific system settings without needing valid credentials. The issue fits into CWE-306, which deals with missing authentication for key functions.
The second flaw, CVE-2026-82078, is a risky reflection flaw known as CWE-470. The details say that someone can change system settings and run any Java bytecode that is already in the application classpath.
Successful use would let the code run in the PaperCut server’s security context. This might give an attacker the same access and permissions as that service.
The biggest danger happens when both problems are used together. An attacker could first take advantage of CVE-2026-81578 to change settings without logging in, then use CVE-2026-82078 to cause harmful actions through unsafe reflection.
| CVE Identifier | Vulnerability Type & CWE | Impact & Technical Mechanism | Remediation Mandate |
| CVE-2026-81578 | Missing Authentication (CWE-306) | Unauthenticated modification of critical server configuration settings | September 14, 2026 (BOD 22-01) |
| CVE-2026-82078 | Unsafe Reflection (CWE-470) | Executes arbitrary Java bytecode from classpath under server context | September 14, 2026 (BOD 22-01) |
| Chained Exploit | Pre-Auth Remote Code Execution | Unauthenticated configuration change chained with reflection execution | Immediate mitigation/isolation |
CISA added a vulnerability to the KEV catalog, showing it is being exploited in the real world. The agency says it does not know if ransomware is used for either flaw. Organizations using PaperCut NG or MF should quickly check vendor advice and use any available fixes.
Security teams should focus on systems open to the internet, check that admin interfaces are not too easy to access from public networks, and see if the PaperCut service has too many permissions.
