CISA Warns of Two PaperCut NG/MF Vulnerabilities Actively Exploited in Attacks

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting PaperCut NG/MF to its Known Exploited Vulnerabilities (KEV) Catalog, warning that attackers are actively exploiting the flaws.

The agency listed CVE-2026-81578 and CVE-2026-82078 on August 31, 2026, and directed affected federal civilian agencies to apply vendor mitigations by September 14 under Binding Operational Directive 26-04.

PaperCut NG/MF is print management software commonly deployed in enterprise, education, government, and managed print environments.

CISA Warns of Two PaperCut NG/MF Vulnerabilities

The pairing is particularly significant because CISA says the two issues can be chained, potentially allowing unauthenticated access to escalate to code execution within the PaperCut server’s security context.

CVE-2026-81578 is a missing-authentication flaw, tracked as CWE-306. An unauthenticated remote attacker can use it to modify certain system configurations, a powerful foothold when an exposed application is reachable from the internet.

On its own, configuration manipulation can undermine expected administrative controls; in a chained attack, it may prepare the application or its settings for the second vulnerability.

CVE-2026-82078, classified as CWE-470, is an unsafe reflection vulnerability. It enables an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode already present on the application classpath.

Crucially, that code would run under the security context of the PaperCut server process. This may give an adversary the same privileges and network visibility available to that service, depending on how the instance is deployed and configured.

Neither entry is currently identified by CISA as being used in ransomware campaigns , and neither requires forensic triage under BOD 26-04. Those designations should not be interpreted as a low-risk assessment.

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting PaperCut NG and PaperCut MF to its Known Exploited Vulnerabilities (KEV) Catalog, warning that threat actors are actively exploiting the flaws in real-world attacks.

The flaws, addressing critical PaperCut vulnerabilities tracked as CVE-2026-81578 and CVE-2026-82078 , can be chained to enable unauthenticated attackers to alter server configurations and execute malicious Java bytecode under the security context of the PaperCut server process.

CISA Warns of PaperCut NG/MF Vulnerabilities

PaperCut NG and PaperCut MF are widely used print-management platforms deployed by schools, enterprises, government agencies, and managed service providers.

Their central role in managing printers, user authentication, quotas, and document workflows can make a compromised PaperCut server a valuable foothold for attackers seeking access to internal networks.

CVE-2026-81578 is a missing authentication vulnerability affecting a critical function in PaperCut NG/MF. The flaw allows an unauthenticated remote attacker to modify certain system configuration settings without first providing valid credentials.

The issue is categorized under CWE-306, which covers missing authentication for critical functions.

The second issue, CVE-2026-82078, is an unsafe reflection vulnerability categorized as CWE-470. According to the vulnerability details, an attacker can manipulate system configuration parameters and execute arbitrary Java bytecode already present on the application classpath.

Successful exploitation would run the code within the security context of the PaperCut server process, potentially giving an attacker the same level of access and permissions held by that service.

The most serious risk emerges when the two flaws are combined.