U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
- CVE-2026-81578 allows pre-auth config changes via page-permission confusion
- CVE-2026-82078 loads unsafe Java classes enabling arbitrary code execution
- Huntress observed discovery-only commands (whoami, ver, tasklist) in the wild
- Distinctive Derby log marker 'DB URL: jdbc:derby:memory:pwn' serves as IOC
- FCEB agencies must remediate by September 14 under BOD 22-01
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1082 System Information DiscoveryT1057 Process Discovery
- Products
- PaperCut NGPaperCut MF
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 63% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.