CVE-2026-82078: 
PaperCut NG vulnerability analysis and mitigation

CVE-2026-82078 is an unsafe dynamic class loading (unsafe reflection) vulnerability in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers, enabling execution of arbitrary Java bytecode under the PaperCut server process security context. It was disclosed on August 27–28, 2026, and immediately observed being exploited as a zero-day in the wild. Affected versions include PaperCut MF/NG prior to 24.1.10, 25.0.2–25.0.12, and 26.0.2–26.0.4. It carries a CVSS v3.1 score of 9.1 (Critical) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, CISA KEV).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / 'Unsafe Reflection'). PaperCut's database connection utilities accept a configurable JDBC driver class name and instantiate it via Java reflection without restricting the input to an approved allowlist. If an attacker can modify system configuration parameters — for example, by chaining with the authentication bypass CVE-2026-81578 — they can specify a malicious or abusable driver class already present on the application classpath (such as H2 or Apache Derby JDBC drivers) and trigger arbitrary Java bytecode execution. The Metasploit module implements two execution paths: H2 JDBC URL injection for version 26.x (in-memory execution) and Derby class-drop-and-load for versions 24.x–25.x (Metasploit PR, GitHub Advisory).

Successful exploitation results in remote code execution under the security context of the PaperCut server process, which typically runs as SYSTEM on Windows or as a dedicated service account on Linux. This grants attackers full confidentiality, integrity, and availability impact on the affected server, including the ability to exfiltrate print job data, user credentials, and configuration secrets. Attackers have been observed deploying Meterpreter payloads and remote access tools, stealing credentials, and using compromised PaperCut servers as a pivot point for lateral movement within enterprise and education networks. An AI-orchestrated campaign reportedly compromised 395–440 organizations across 48 countries by chaining CVE-2026-81578 (authentication bypass) with CVE-2026-82078 (CISA KEV, Metasploit PR).

CVE-2026-82078 was actively exploited as a zero-day before patches were available and was added to CISA's Known Exploited Vulnerabilities catalog on August 31, 2026, with a federal remediation deadline of September 14, 2026 (CISA KEV). A fully functional Metasploit exploit module (papercut_ng_external_user_lookup_rce) was merged on September 3, 2026, chaining CVE-2026-81578 (authentication bypass) with CVE-2026-82078 to achieve pre-authentication RCE (Metasploit PR). Additional public PoC code exists on GitHub (e.g., yora1928/PaperCut-CVE-2026-81578-82078). The EPSS score is approximately 1.69% (76th percentile). Meterpreter has been weaponized against this vulnerability in real-world attacks targeting schools, universities, and enterprises globally, with an AI-orchestrated campaign attributed to a threat actor reportedly linked to Russian infrastructure (GitHub Advisory).

1. Reconnaissance: Identify internet-facing PaperCut MF/NG instances (default port 9191) using Shodan, Censys, or similar tools. Target versions prior to 24.1.10, 25.0.13, or 26.0.5.
2. Authentication bypass (CVE-2026-81578): Exploit the companion authentication bypass vulnerability to gain access to the PaperCut admin configuration interface without valid credentials. The Metasploit module automates this step via a Tapestry request confusion technique.
3. Modify database driver configuration: Using the gained access, submit a crafted HTTP POST request to the PaperCut ConfigEditor endpoint to set the external user lookup database driver class name to a malicious or abusable class (e.g., an H2 or Derby JDBC driver class) present on the application classpath.
4. Trigger external user lookup: Send a request that causes PaperCut to instantiate the configured driver class via Java reflection, executing the attacker-controlled bytecode under the PaperCut server process context.
5. Payload delivery: For version 26.x, the H2 JDBC URL executes a Groovy bootstrap in-memory. For versions 24.x–25.x, a helper Java class is dropped via Derby and loaded to execute the payload.
6. Post-exploitation: Obtain a Meterpreter or reverse shell session running as SYSTEM (Windows) or the papercut service account (Linux). Proceed with credential harvesting, lateral movement, or data exfiltration. The module resets PaperCut configuration to defaults after exploitation (Metasploit PR, GitHub Advisory).

• Network: Unexpected outbound connections from the PaperCut server process to unknown external IPs on high ports (reverse shell/Meterpreter); HTTP POST requests to PaperCut's ConfigEditor or external user lookup endpoints with unusual JDBC driver class names in parameters; scanning activity against port 9191 from external sources.
• Logs: PaperCut application logs showing configuration changes to database driver settings (especially to H2 or Derby driver class names) not initiated by known administrators; Java reflection or class instantiation errors in server logs; external user lookup trigger events immediately following configuration changes.
• File System: Unexpected .class or .csv files dropped in the PaperCut installation directory (used by Derby-based exploitation on 24.x–25.x); new web shells or scripts in the PaperCut web root; Meterpreter or RAT binaries written to disk by the PaperCut service account.
• Process: Unusual child processes spawned by the PaperCut Java process (e.g., cmd.exe, powershell.exe, /bin/bash, curl, wget); Java processes making outbound network connections to attacker-controlled infrastructure.
• Configuration: Unauthorized changes to PaperCut's external user lookup or database driver configuration settings; configuration values referencing non-standard JDBC driver class names (CISA KEV, Metasploit PR).

PaperCut has released patched versions: 24.1.10, 25.0.13, and 26.0.5 for both PaperCut MF and PaperCut NG. Organizations should upgrade immediately, as the vendor's first emergency patch was bypassed and a second patch was required before the final maintenance releases were issued (GitHub Advisory, CISA KEV). CISA mandated federal agencies remediate by September 14, 2026 under BOD 26-04. As interim mitigations: restrict network access to the PaperCut admin interface (port 9191) to trusted IP ranges only; implement access controls to limit who can modify system configuration parameters; monitor configuration changes for unauthorized modifications to database driver settings; and consider network segmentation to isolate PaperCut servers from broader enterprise networks.

PaperCut issued an urgent security advisory on August 27, 2026, and subsequently released two emergency patches before shipping fully QA-tested maintenance releases, reflecting the severity and rapid exploitation pace (GitHub Advisory). CISA added both CVE-2026-82078 and the companion CVE-2026-81578 to the KEV catalog on August 31, 2026, and issued a formal alert. Rapid7 published an ETR blog post and contributed the Metasploit module, noting the vendor's second emergency patch successfully remediated the exploit chain (Metasploit PR). GreyNoise documented an AI-orchestrated exploitation campaign that compromised 395–440 organizations across 48 countries, drawing significant media coverage from The Hacker News, BleepingComputer, SecurityWeek, and The Register. Security researchers on social media (Mastodon, X/Twitter, LinkedIn) highlighted the novelty of AI agents being used to automate exploitation at scale, with some noting that 11 organizations were breached in as little as 26 seconds. The education sector — particularly U.S. and European schools and universities — was prominently targeted, generating widespread concern among IT administrators.