Skip to content

CVE-2026-82078

Unsafe Reflection in PaperCut NG/MF. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 31 August 2026.

Product
PaperCut NG/MF
Added to CISA's catalog
Federal fix-by date
Ransomware
No known use in ransomware campaigns
Vendor advisories
Sources
CISA’s catalog, NVD entry

CISA’s description.

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

More from PaperCut this year.

  • CVE-2026-81578 Missing Authentication for Critical Function, added
  • CVE-2023-27351 Improper Authentication, added

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.