CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
Overview
PaperCut NG/MF contains an unsafe reflection flaw in its database connection utilities that allows arbitrary Java class instantiation under the print server process's security context. Versions prior to 24.1.10, 25.0.13, and 26.0.5 are affected. When chained with CVE-2026-81578, an unauthenticated remote attacker can achieve full remote code execution, gaining complete control over the server's confidentiality, integrity, and availability.
Vulnerability details
The vulnerability (CWE-470) arises because PaperCut NG/MF reads a configurable database driver class name from system parameters and instantiates that class via Java reflection without checking it against an allowlist of approved drivers. Any Java class already present on the application classpath can be loaded and executed this way. Because the class selection is driven by attacker-controlled configuration input rather than a fixed internal value, the trust boundary between configuration data and code execution is absent, making the instantiation mechanism a direct code execution primitive.
Exploitation requires first satisfying a precondition: the attacker must be able to write to PaperCut's system configuration parameters. In the documented unauthenticated chain, CVE-2026-81578 provides an auth bypass that satisfies this requirement. Once configuration write access is obtained, the attacker submits a crafted HTTP request that sets the database driver class name to an attacker-chosen value. The Metasploit module implements two execution paths: an H2 database driver path for version 26 targets and a Derby driver path for versions 24 through 25, with an embedded HTTP server used to deliver the Java payload. The result is remote code execution under the PaperCut server process account.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor PaperCut application logs and web server access logs for unexpected POST requests to configuration or database-settings endpoints, particularly those modifying driver class name parameters from sources outside your administrative IP range.
- Alert on PaperCut server process spawning unexpected child processes (shells, scripting interpreters, or network utilities) on Windows or Linux hosts, which would indicate successful classpath-based code execution.
- Audit PaperCut system configuration change records for modifications to database driver class name fields, especially changes that do not correspond to a known administrative change-control event.
Remediation
Additional hardening
- Upgrade PaperCut MF/NG to version 24.1.10, 25.0.13, or 26.0.5 (or later within each release line) as the primary remediation; see the vendor advisory in References for build-specific details.
- Restrict network access to the PaperCut administration interface to trusted management hosts only, using host-based firewall rules or network segmentation, to reduce the attack surface for both this flaw and the chained auth bypass.
- Apply the principle of least privilege to the PaperCut server process account, limiting its OS-level permissions so that any code executed under its context cannot reach sensitive systems or write to critical directories.
- If immediate patching is not possible, disable or block external access to PaperCut configuration endpoints at the perimeter and monitor for anomalous configuration changes as a compensating control.
Key dates
References
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://github.com/rapid7/metasploit-framework/pull/21842
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-82078
Frequently asked questions
Does CVE-2026-82078 affect my FedRAMP authorization?
If PaperCut NG/MF runs inside your authorization boundary, CVE-2026-82078 directly affects your Federal Risk and Authorization Management Program (FedRAMP) authorization. CISA has listed this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 14, 2026. An unpatched KEV inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2026-82078?
Knox does not patch PaperCut NG/MF on your behalf. Under the FedRAMP shared-responsibility model, remediating CVE-2026-82078 is your obligation. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that document the fix for your next assessment. The work of applying the patch is yours; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-82078. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal problem.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-82078 isn't remediated by September 14, 2026?
An unremediated CVE-2026-82078 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out before the September 14, 2026 deadline keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
