InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed two flaws in PaperCut NG and PaperCut MF in its Known Exploited Vulnerabilities (KEV) Catalog. They warn that hackers are using these flaws in real attacks.
The flaws with PaperCut, known as CVE-2026-81578 and CVE-2026-82078, can be linked together. This lets attackers who are not signed in change server settings and run harmful Java code using the PaperCut server’s permissions.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
CISA Warns of PaperCut NG/MF Flaws
PaperCut NG and PaperCut MF are popular tools for managing printers. They are used by schools, businesses, government offices, and service providers. Their main job is to handle printers, user logins, limits, and document processes. If a PaperCut server is hacked, it can give attackers a good way to reach internal networks.
CVE-2026-81578 is a flaw where authentication is missing in an important function of PaperCut NG/MF. This flaw lets a remote attacker change specific system settings without needing valid credentials. The issue fits into CWE-306, which deals with missing authentication for key functions.
The second flaw, CVE-2026-82078, is a risky reflection flaw known as CWE-470. The details say that someone can change system settings and run any Java bytecode that is already in the application classpath.
Successful use would let the code run in the PaperCut server’s security context. This might give an attacker the same access and permissions as that service.
The biggest danger happens when both problems are used together. An attacker could first take advantage of CVE-2026-81578 to change settings without logging in, then use CVE-2026-82078 to cause harmful actions through unsafe reflection.
| CVE Identifier | Vulnerability Type & CWE | Impact & Technical Mechanism | Remediation Mandate |
| CVE-2026-81578 | Missing Authentication (CWE-306) | Unauthenticated modification of critical server configuration settings | September 14, 2026 (BOD 22-01) |
| CVE-2026-82078 | Unsafe Reflection (CWE-470) | Executes arbitrary Java bytecode from classpath under server context | September 14, 2026 (BOD 22-01) |
| Chained Exploit | Pre-Auth Remote Code Execution | Unauthenticated configuration change chained with reflection execution | Immediate mitigation/isolation |
CISA added a vulnerability to the KEV catalog, showing it is being exploited in the real world. The agency says it does not know if ransomware is used for either flaw. Organizations using PaperCut NG or MF should quickly check vendor advice and use any available fixes.
Security teams should focus on systems open to the internet, check that admin interfaces are not too easy to access from public networks, and see if the PaperCut service has too many permissions.
