CVE-2026-82078: listed in the CISA KEV catalog CVE-2026-82078 · KEV 2026-08-28 · patch available
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Is CVE-2026-82078 exploited? Listed in the CISA KEV catalog on 2026-08-28. Federal remediation due 2026-09-11. Past that date by 48 days. Public exploit code: packaged in a public tool. Which products and versions are affected? PaperCut · PaperCut MF/NG · >= 0, < 24.1.10, >= 25.0.0, < 25.0.13, >= 26.0.0, < 26.0.5 Is there a patch? Yes. Update to one of these or later:
PaperCut MF/NG 24.1.10 PaperCut MF/NG 25.0.0 25.0.13 PaperCut MF/NG 26.0.0 26.0.5
From PaperCut's CVE record · PaperCut advisory
What PlainSec published about CVE-2026-82078 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-09.
CVE-2026-82078: listed in the CISA KEV catalog CVE-2026-82078 · KEV 2026-08-28 · patch available
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Is CVE-2026-82078 exploited? Listed in the CISA KEV catalog on 2026-08-28. Federal remediation due 2026-09-11. Past that date by 48 days. Public exploit code: packaged in a public tool. Which products and versions are affected? PaperCut · PaperCut MF/NG · >= 0, < 24.1.10, >= 25.0.0, < 25.0.13, >= 26.0.0, < 26.0.5 Is there a patch? Yes. Update to one of these or later:
PaperCut MF/NG 24.1.10 PaperCut MF/NG 25.0.0 25.0.13 PaperCut MF/NG 26.0.0 26.0.5
From PaperCut's CVE record · PaperCut advisory
What PlainSec published about CVE-2026-82078 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-09.