InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed two flaws in PaperCut NG and PaperCut MF in its Known Exploited Vulnerabilities (KEV) Catalog. They warn that hackers are using these flaws in real attacks.
The flaws with PaperCut, known as CVE-2026-81578 and CVE-2026-82078, can be linked together. This lets attackers who are not signed in change server settings and run harmful Java code using the PaperCut server’s permissions.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
CISA Warns of PaperCut NG/MF Flaws
PaperCut NG and PaperCut MF are popular tools for managing printers. They are used by schools, businesses, government offices, and service providers. Their main job is to handle printers, user logins, limits, and document processes. If a PaperCut server is hacked, it can give attackers a good way to reach internal networks.
CVE-2026-81578 is a flaw where authentication is missing in an important function of PaperCut NG/MF. This flaw lets a remote attacker change specific system settings without needing valid credentials. The issue fits into CWE-306, which deals with missing authentication for key functions.
The second flaw, CVE-2026-82078, is a risky reflection flaw known as CWE-470. The details say that someone can change system settings and run any Java bytecode that is already in the application classpath.
Successful use would let the code run in the PaperCut server’s security context. This might give an attacker the same access and permissions as that service.
The biggest danger happens when both problems are used together. An attacker could first take advantage of CVE-2026-81578 to change settings without logging in, then use CVE-2026-82078 to cause harmful actions through unsafe reflection.
| CVE Identifier | Vulnerability Type & CWE | Impact & Technical Mechanism | Remediation Mandate |
| CVE-2026-81578 | Missing Authentication (CWE-306) | Unauthenticated modification of critical server configuration settings | September 14, 2026 (BOD 22-01) |
| CVE-2026-82078 | Unsafe Reflection (CWE-470) | Executes arbitrary Java bytecode from classpath under server context | September 14, 2026 (BOD 22-01) |
| Chained Exploit | Pre-Auth Remote Code Execution | Unauthenticated configuration change chained with reflection execution | Immediate mitigation/isolation |
CISA added a vulnerability to the KEV catalog, showing it is being exploited in the real world. The agency says it does not know if ransomware is used for either flaw. Organizations using PaperCut NG or MF should quickly check vendor advice and use any available fixes.
Security teams should focus on systems open to the internet, check that admin interfaces are not too easy to access from public networks, and see if the PaperCut service has too many permissions.
