PaperCut security advisory (AV26-858) – Update 2
CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.
Canada's Cyber Centre updated security advisory AV26-858, noting PaperCut MF and PaperCut NG versions prior to the v24, v25, and v26 Emergency Patch Release 2 are affected by CVE-2026-81578 and CVE-2026-82078. Open-source reporting indicates both vulnerabilities are being exploited in the wild. In Update 2 (August 31, 2026), CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and the Cyber Centre urges administrators to apply the emergency patches immediately.
- Both CVEs exploited in the wild per open-source reporting
- CISA added both to the KEV catalog on August 31, 2026
- Affects PaperCut MF and NG before v24-v26 Emergency Patch Release 2
- Federal agencies face KEV remediation deadlines
- Apply emergency patches across all affected branches
- Products
- PaperCut MFPaperCut NG
- Organizations
- PaperCutCISACanadian Centre for Cyber Security
- Countries
- CanadaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
Serial number: AV26-858 Date: August 28, 2026 Updated: August 31, 2026 As of August 27, 2026, PaperCut is affected by vulnerabilities in the following products: PaperCut MF Prior to v24 Emergency Patch Release 2 Prior to v25 Emergency Patch Release 2 Prior to v26 Emergency Patch Release 2 PaperCut NG Prior to v24 Emergency Patch Release 2 Prior to v25 Emergency Patch Release 2 Prior to v26 Emergency Patch Release 2…
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.