CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 to the KEV catalog, mandating federal patching.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-81578 (PaperCut NG/MF missing authentication for critical function) and CVE-2026-82078 (PaperCut NG/MF unsafe reflection). Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize and apply these updates. The KEV listing signals observed exploitation of the PaperCut print management platform.
- Two PaperCut NG/MF vulnerabilities added to the KEV catalog.
- CVE-2026-81578 is missing authentication; CVE-2026-82078 is unsafe reflection.
- BOD 26-04 requires FCEB agencies to patch within required timeframes.
- Products
- PaperCut NGPaperCut MF
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.