CVE-2026-82078: 
PaperCut NG vulnerability analysis and mitigation

CVE-2026-82078 is an unsafe dynamic class loading vulnerability ("Unsafe Reflection") in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers, enabling execution of arbitrary Java bytecode under the PaperCut server process security context. Affected versions are all releases prior to 24.1.10, 25.0.13, and 26.0.5. It was published on August 28, 2026, with a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, PaperCut Advisory).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / 'Unsafe Reflection'): PaperCut's database connection utilities accept a configurable driver class name and instantiate it via dynamic class loading without restricting the input to an approved allowlist (GitHub Advisory). An attacker who can manipulate system configuration parameters — for example, by chaining this with an authentication bypass vulnerability such as CVE-2026-81578 — can specify a malicious class name already present on the application classpath, causing the server to execute arbitrary Java bytecode (The Hacker News, dev.to Analysis). The attack vector is network-based, requires no user interaction, and has low attack complexity, though it nominally requires high privileges — a requirement that can be bypassed when chained with CVE-2026-81578 to achieve pre-authentication RCE (Rapid7 ETR).

Successful exploitation allows an attacker to execute arbitrary Java bytecode under the security context of the PaperCut server process, resulting in full compromise of confidentiality, integrity, and availability of both the vulnerable system and subsequent systems it can reach (GitHub Advisory). This enables data exfiltration of print job records and user credentials managed by PaperCut, unauthorized modification of system data, and potential denial of service. When chained with the authentication bypass CVE-2026-81578, attackers can achieve pre-authentication remote code execution, significantly expanding the attack surface and enabling lateral movement within enterprise networks (The Hacker News, Huntress).

CVE-2026-82078 is being actively exploited in the wild, with exploitation reported by multiple threat intelligence sources including Threadlinqs and Huntress (Threadlinqs Intel, Huntress). Public proof-of-concept code has been published on GitHub (e.g., github.com/yora1928/PaperCut-CVE-2026-81578-82078 and github.com/virologi-info/papercut-toolkit), and the vulnerability is being chained with CVE-2026-81578 to achieve pre-authentication RCE (SecurityWeek, BleepingComputer). The EPSS score is approximately 0.462% (38th percentile). An AI-built toolkit named GRYXA has also been reported in connection with exploitation of these flaws (Undercode News). CISA KEV catalog status is not confirmed in available sources.

1. Reconnaissance: Identify internet-facing PaperCut MF/NG instances (versions prior to 24.1.10, 25.0.13, or 26.0.5) using Shodan, Censys, or similar tools targeting default PaperCut web ports (typically TCP 9191/9192).
2. Authentication Bypass (Chain with CVE-2026-81578): Exploit the companion authentication bypass vulnerability CVE-2026-81578 (a Tapestry request confusion flaw) to gain administrative access to the PaperCut web interface without valid credentials (dev.to Analysis, CTI Pilot).
3. Manipulate Database Driver Configuration: Using the administrative access obtained, navigate to the database configuration settings and modify the JDBC driver class name parameter to reference a malicious class already present on the PaperCut application classpath.
4. Trigger Dynamic Class Loading: Initiate a database connection test or restart the relevant service, causing PaperCut to instantiate the attacker-specified class via unsafe reflection (CWE-470), executing arbitrary Java bytecode under the server process context (GitHub Advisory).
5. Achieve Remote Code Execution: The loaded malicious class executes attacker-controlled code (e.g., a reverse shell, credential harvester, or ransomware dropper) with the privileges of the PaperCut server process, enabling full system compromise and lateral movement (Huntress, The Hacker News).

• Network: Unusual outbound connections from the PaperCut server process to unknown external IPs; unexpected connections on non-standard ports initiated by the PaperCut Java process; scanning activity targeting TCP 9191/9192 from external sources.
• Logs: PaperCut application logs showing unexpected database driver class names being loaded or instantiation errors for unknown classes; admin audit logs reflecting configuration changes to database driver settings by unexpected accounts or at unusual times; authentication events bypassing normal login flows.
• File System: New or modified JAR files or class files in the PaperCut installation directory or classpath; unexpected web shells or scripts dropped in the PaperCut web root; new scheduled tasks or cron jobs created by the PaperCut service account.
• Process: Unusual child processes spawned by the PaperCut Java process (e.g., cmd.exe, /bin/bash, powershell.exe, curl, wget); presence of GRYXA toolkit artifacts or credential-harvesting tools on the host (Huntress, Elastic Detection Rules).

PaperCut has released patched versions addressing CVE-2026-82078 (and the companion CVE-2026-81578): 24.1.10, 25.0.13, and 26.0.5 — organizations should upgrade immediately to one of these versions (PaperCut Advisory). Note that an initial patch was bypassed by researchers, necessitating a second emergency patch release, so ensure the latest available version is applied (BleepingComputer). As interim mitigations: restrict network access to PaperCut administration interfaces (ports 9191/9192) to trusted IP ranges only; limit access to system configuration parameters to authorized administrators; implement an allowlist of approved database drivers; and monitor for unauthorized configuration changes or anomalous process behavior on PaperCut servers.

PaperCut issued an urgent security advisory on August 27–28, 2026, acknowledging active exploitation and releasing emergency patches — a second patch was required after researchers demonstrated a bypass of the initial fix (PaperCut Advisory, BleepingComputer). Rapid7 published an emergency threat response (ETR) report confirming zero-day exploitation in the wild, and Huntress released a detailed blog post on active exploitation observations (Rapid7 ETR, Huntress). Government cybersecurity agencies including NHS Digital (UK) and the Canadian Centre for Cyber Security issued alerts urging immediate patching (NHS Cyber Alert, CCCS Advisory). Security community discussion was widespread across LinkedIn, Mastodon, Reddit, and X/Twitter, with researchers highlighting the chaining of CVE-2026-81578 and CVE-2026-82078 for pre-authentication RCE as particularly severe.