by Kastro
Paper/Archive/CVE-2026-82078

CVE-2026-82078

PaperCut PaperCut MF/NG — PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

KEV · due 14 SepEPSS 61%public exploitSSVC actCVSS 9.4
critical.is priorityof 100
98
CVSS 9.4 (CNA)9.4 / 10 × 3028.2In CISA KEV+3030.0EPSS percentile 99.2.992 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Affected

ProductAffectedFixed inSource
PaperCut MF/NG< 24.1.1024.1.10CNA
PaperCut MF/NG25.0.0 – < 25.0.1325.0.13CNA
PaperCut MF/NG26.0.0 – < 26.0.526.0.5CNA

Scores by source

PaperCut (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refpapercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisoryexploitgithub.com/rapid7/metasploit-framework/pull/21842refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078kevcisa.gov/known-exploited-vulnerabilities-catalog