CISA Flags Multiple PaperCut NG/MF Flaws Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities related to PaperCut NG/MF to its Known Exploited Vulnerabilities (KEV) catalog, warning that these flaws are being actively exploited.

The vulnerabilities, identified as CVE-2026-81578 and CVE-2026-82078, can be combined to enable unauthenticated attackers to modify server configurations and execute arbitrary Java bytecode within the PaperCut server process.

PaperCut NG/MF is a widely used platform for managing printing, scanning, device access, quotas, and print accounting functions.

Because it can be integrated with enterprise identity systems and deployed on internal networks, a compromise could grant threat actors a foothold in environments where print-management infrastructure has broad connectivity.

Multiple PaperCut NG/MF Flaws

CVE-2026-81578 is a missing-authentication vulnerability affecting a critical function in PaperCut NG/MF. This flaw allows an unauthenticated remote attacker to modify certain system configuration settings, as noted in CISA’s KEV entry.

The vulnerability falls under CWE-306, which addresses missing authentication for critical functions.

The second vulnerability, CVE-2026-82078, is classified as an unsafe reflection vulnerability (CWE-470). An attacker can manipulate system configuration parameters and execute arbitrary Java bytecode already present on the application classpath, operating under the security context of the PaperCut server process.

Individually, these vulnerabilities pose serious risks. When exploited together, CVE-2026-81578 provides unauthenticated access to alter settings, while CVE-2026-82078 can leverage that access to execute code.

This attack pathway may enable an intruder to execute malicious logic with the privileges assigned to the PaperCut service account.

CISA added both vulnerabilities to the KEV catalog on August 31, 2026, with a remediation deadline of September 14, 2026. Federal Civilian Executive Branch agencies must implement mitigations in accordance with vendor instructions and align with CISA’s Binding Operational Directive 26-04, which prioritizes security updates based on risk.

CISA advises organizations to assess whether affected PaperCut systems are exposed to the internet, adhere to applicable patching requirements for cloud services, and cease using the product if mitigations are not available.

Currently, CISA’s entries indicate that ransomware campaign use is unknown and does not necessitate forensic triage under BOD 26-04.

Recommended Defensive Actions

Security teams should take immediate action to:

• Identify all PaperCut NG/MF servers, including those hosted in the cloud and managed by subsidiaries.
• Apply vendor-provided patches or mitigations before the September 14 deadline.
• Restrict administrative interfaces to trusted management networks and eliminate unnecessary exposure to the internet.
• Review changes to PaperCut configurations, service account activities, Java process behaviors, and outbound connections for signs of compromise.
• Ensure that PaperCut service accounts adhere to least-privilege practices and do not have access to unnecessary systems.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC