Act nowKnown exploited

Advisory · CVE-2026-82078

PaperCut servers under active attack via unsafe class loading

An unsafe dynamic class loading flaw in PaperCut NG/MF lets attackers execute Java bytecode on the server; PaperCut confirms active exploitation and customer incidents.

Advisory published August 31, 2026Independent summary
Vendor
PaperCut
Product
PaperCut NG/MF
Identifier / CWE
CVE-2026-82078
CWE-470
Action timing
Sep 21, 2026
ELI5

Explain it like I’m five

PaperCut lets a setting name the driver that loads at startup but never checks the name against an approved list. Point it at a hostile package and PaperCut runs whatever is inside.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Config manipulated

    An attacker who can influence system configuration parameters supplies a malicious database driver class name. This is chained with an authentication bypass (CVE-2026-81578) that PaperCut disclosed in the same bulletin.

  2. 02No allowlist check

    PaperCut instantiates the named class without validating it against an approved list of drivers.

  3. 03Bytecode executes

    Arbitrary Java bytecode from the application classpath runs under the security context of the PaperCut server process.

  4. 04Foothold established

    Observed post-compromise activity includes spawning shells, installing remote access tooling, and domain reconnaissance.

What happened

CISA added CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on August 31, 2026. PaperCut’s urgent security bulletin of August 27, 2026 states its response team “is investigating active exploitation” and that it is “aware of confirmed customer incidents.”

The database connection utilities of PaperCut NG and PaperCut MF instantiate database driver classes based on configurable driver names without validating them against an allowlist of approved drivers (CWE-470, unsafe reflection). If an attacker can manipulate system configuration parameters, this allows execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. The bulletin pairs this flaw with CVE-2026-81578, an authentication bypass in the web management interface that unauthenticated remote requests can use to modify system configurations, which is the practical chain attackers use. A public Metasploit module exists for the vulnerability.

PaperCut published security maintenance releases 26.0.5, 25.0.13, and 24.1.10, which replace the earlier emergency patches. There are no patches for version 23 or earlier; those installs must be upgraded to a supported version line. The bulletin lists indicators of compromise, including server.log entries such as DB URL: jdbc:derby:memory:pwn;create=true and Database error looking up cardID: VALUES CAST(X'cafebabe..., files with random five-character names (.class, .cmd, .out) written to the install directory, the pc-app process launching shells, and post-compromise installation of remote access tools (a SimpleHelp agent and AnyDesk).

What to do

  1. Upgrade all PaperCut Application Servers, Site Servers, and secondary servers to 26.0.5, 25.0.13, or 24.1.10, matching your version line. If you are on emergency patch release 3 you are protected but should still move to a maintenance release; releases 1 and 2 must upgrade now.
  2. Hunt for the published indicators: suspicious server.log entries, missing or truncated logs, random five-character .class/.cmd/.out files, and unexpected SimpleHelp or AnyDesk installations.
  3. If any indicator is found, follow PaperCut’s guidance: secure current backups, completely wipe and rebuild the Application Server, and restore a clean backup from before the suspicious activity.
  4. Restrict web access to the PaperCut Application Server to trusted addresses; the bulletin notes unpatched, publicly reachable servers continue to be targeted.
  5. Engage your incident response process for any confirmed compromise, since observed post-exploitation includes domain reconnaissance (nltest, quser).

Management note

Print servers are easy to forget and hard to remove, which is exactly why attackers like them: they run as privileged services, sit inside the network, and rarely get patched. PaperCut is telling customers to wipe and rebuild on suspicion of compromise, not just patch, which signals how deep the observed intrusions go. Treat this as an incident-response exercise first and a patching exercise second.