InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed two flaws in PaperCut NG and PaperCut MF in its Known Exploited Vulnerabilities (KEV) Catalog. They warn that hackers are using these flaws in real attacks.
The flaws with PaperCut, known as CVE-2026-81578 and CVE-2026-82078, can be linked together. This lets attackers who are not signed in change server settings and run harmful Java code using the PaperCut server’s permissions.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
CISA Warns of PaperCut NG/MF Flaws
PaperCut NG and PaperCut MF are popular tools for managing printers. They are used by schools, businesses, government offices, and service providers. Their main job is to handle printers, user logins, limits, and document processes. If a PaperCut server is hacked, it can give attackers a good way to reach internal networks.
CVE-2026-81578 is a flaw where authentication is missing in an important function of PaperCut NG/MF. This flaw lets a remote attacker change specific system settings without needing valid credentials. The issue fits into CWE-306, which deals with missing authentication for key functions.
The second flaw, CVE-2026-82078, is a risky reflection flaw known as CWE-470. The details say that someone can change system settings and run any Java bytecode that is already in the application classpath.
Successful use would let the code run in the PaperCut server’s security context. This might give an attacker the same access and permissions as that service.
The biggest danger happens when both problems are used together. An attacker could first take advantage of CVE-2026-81578 to change settings without logging in, then use CVE-2026-82078 to cause harmful actions through unsafe reflection.
| CVE Identifier | Vulnerability Type & CWE | Impact & Technical Mechanism | Remediation Mandate |
| CVE-2026-81578 | Missing Authentication (CWE-306) | Unauthenticated modification of critical server configuration settings | September 14, 2026 (BOD 22-01) |
| CVE-2026-82078 | Unsafe Reflection (CWE-470) | Executes arbitrary Java bytecode from classpath under server context | September 14, 2026 (BOD 22-01) |
| Chained Exploit | Pre-Auth Remote Code Execution | Unauthenticated configuration change chained with reflection execution | Immediate mitigation/isolation |
CISA added a vulnerability to the KEV catalog, showing it is being exploited in the real world. The agency says it does not know if ransomware is used for either flaw. Organizations using PaperCut NG or MF should quickly check vendor advice and use any available fixes.
Security teams should focus on systems open to the internet, check that admin interfaces are not too easy to access from public networks, and see if the PaperCut service has too many permissions.
