PaperCut MF/NG CVE-2026-82078

Exploitation requires the attacker to be able to manipulate PaperCut system configuration parameters - specifically the database driver name setting - which corresponds to administrative/configuration-level access (consistent with CVSS PR:H). A second concrete prerequisite is that a suitable class capable of yielding code execution must already reside on the PaperCut server's Java classpath, since the flaw loads classpath-resident bytecode rather than remote code. Limiting factors: no exploitation is possible without configuration-write privileges, no user interaction is required (UI:N), the attack is network-reachable (AV:N) but only against the administrative configuration surface, and success depends on an available loadable gadget class in the deployed environment.

The vendor CVSS 4.0 base score is 9.4 (critical) with AV:N/AC:L/AT:N/PR:H/UI:N and high impact to both the vulnerable and subsequent systems, reflecting full RCE. The single most important limiting signal is PR:H: exploitation requires the ability to change PaperCut system configuration, which normally means an authenticated administrative context or a separate flaw that exposes configuration control - this is not a pre-auth internet-facing RCE. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automatable mass exploitation at this time. That said, PaperCut is a high-value target with a documented history of exploited RCE flaws, so any operator - even a modestly staffed mid-sized IT team - should treat a config-to-RCE issue as urgent and prioritize patching, because the barrier (admin/config access) can collapse quickly if the admin interface is exposed or credentials are weak. Net: high-priority to patch, but real-world risk is gated by how well administrative/configuration access is controlled.

An attacker who has obtained PaperCut administrative access (via stolen admin credentials, an exposed admin console, or a chained privilege flaw) edits the database connection configuration and sets the driver class name to a class on the server classpath that executes attacker-controlled behavior when instantiated. On the next connection attempt, the PaperCut server reflectively loads and runs that class, executing arbitrary Java code as the server process. No public POC is identified at time of analysis.