Which versions of PaperCut MF/NG are affected by CVE-2026-82078?

PaperCut MF and NG contain a critical remote code execution vulnerability accessible to users with administrative configuration privileges.. A patch is available.

Is there a public PoC exploit available for CVE-2026-82078?

Yes, a public proof-of-concept exploit is available for CVE-2026-82078. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-82078?

Within 24 hours, inventory all instances of PaperCut MF and NG and document their versions to confirm affected systems. Within 7 days, restrict administrative access to only essential personnel, require multi-factor authentication for all administrative accounts, enable comprehensive audit logging of configuration changes, and implement network segmentation to limit the impact of a potential compromise. Within 30 days, continuously monitor PaperCut vendor security channels for patch releases, test patches in a non-production environment immediately upon availability, and prepare a deployment plan for rapid installation once the vendor releases a fix.

PaperCut MF/NG CVE-2026-82078

Q: What is the CVSS score of CVE-2026-82078?

CVE-2026-82078 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-67714 CRITICAL

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-08-28 PaperCut

GHSA-mjg5-wj9r-9mfx

Java RCE Papercut Mf Ng

9.4

CVSS 4.0 · Vendor: PaperCut

Severity by source

Vendor (PaperCut) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable admin/config action with no user interaction, but requires configuration privileges (PR:H); RCE escaping the app process into full host control justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (PaperCut).

CVSS VectorVendor: PaperCut

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Aug 28, 2026 - 23:22 vuln.today

Patch available

Aug 28, 2026 - 17:02 EUVD

Analysis Generated

Aug 28, 2026 - 15:46 vuln.today

CVE Published

Aug 28, 2026 - 11:45 cve.org

CRITICAL 9.4

DescriptionCVE.org

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Articles & Coverage 1

News Critical RCE in PaperCut MF/NG via Unsafe JDBC Class Loading - CVE-2026-82078 Aug 29, 2026

AnalysisAI

Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to be able to manipulate PaperCut system configuration parameters - specifically the database driver name setting - which corresponds to administrative/configuration-level access (consistent with CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 4.0 base score is 9.4 (critical) with AV:N/AC:L/AT:N/PR:H/UI:N and high impact to both the vulnerable and subsequent systems, reflecting full RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply the fixed release referenced in PaperCut's 27 August 2026 security bulletin (https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/); the exact fixed version number is not included in the provided data and must be taken from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report.