CVE-2026-82078: critical vulnerability in PaperCut NG/MF, actively exploited

CVE-2026-82078: critical vulnerability in PaperCut NG/MF, actively exploited

In short

A critical vulnerability (CVE-2026-82078) has been published affecting PaperCut NG and PaperCut MF, with a CVSS score of 9.4 out of 10, rated as "critical" [1]. The vulnerability is listed in CISA's catalog of Known Exploited Vulnerabilities (KEV) [2], which means there is already evidence of real attacks exploiting it. If your company uses PaperCut to manage printing, this should be treated as a high priority today: identify whether you have exposed instances and apply the vendor's patch as soon as it becomes available.

What it is and why it matters

PaperCut NG and PaperCut MF are print management solutions widely used by businesses, public administrations, and educational institutions to control costs, quotas, and track network printers. The issue identified as CVE-2026-82078 resides in the application's database connection utilities: the system dynamically loads Java classes corresponding to database drivers based on a configurable name, without verifying that this name belongs to an allowed list of drivers [1].

In practice, this means that if an attacker manages to manipulate certain system configuration parameters, they can force the loading and execution of arbitrary Java code already present on the application's classpath, with the same privileges as the PaperCut server process itself [1]. Since this type of server usually runs with elevated permissions within the corporate network, successful exploitation can lead to full control over that machine and, from there, serve as a foothold to move laterally toward other internal systems.

OCIRIA's intelligence team has also identified that this vulnerability can be chained with another one (CVE-2026-81578) to maximize the impact of an attack, which raises its real criticality beyond what the CVSS score alone reflects.

Who is affected

This affects organizations of any size that use PaperCut NG or PaperCut MF to manage their printing infrastructure [1]. This includes professional firms, healthcare centers, local administrations, educational institutions, and companies in any sector with centrally managed printer fleets. The risk is higher the more exposed the management server is, whether directly to the internet or to broad segments of the internal network.

How to know if you are vulnerable

The first step is an honest inventory: does your organization have PaperCut NG or PaperCut MF deployed, and on which version? Check with your IT provider or print system administrator whether the software is active and accessible from outside the local network.

It is also worth reviewing the PaperCut server logs for anomalous activity related to class loading or unexpected process execution, as recommended by OCIRIA's analysis of this vulnerability. And, in general, it is good practice to check which services and ports in your organization are visible from the internet: many exploitations of this type of vulnerability start precisely with management systems that ended up being publicly accessible without any real need to be.

How to protect yourself

1. Confirm whether you use PaperCut NG/MF and which version, together with your provider or IT team.

2. Apply the vendor's security update as soon as it is available for your version; since the vulnerability is already being actively exploited according to CISA [2], patching should not be delayed.

3. Restrict access to the PaperCut administration server: it should not be accessible from the internet without additional controls (VPN, IP allowlisting, strengthened authentication).

4. Review logs on the server for signs of suspicious code execution or unauthorized configuration changes, especially related to database connection parameters.

5. Prioritize this vulnerability together with CVE-2026-81578, since OCIRIA's team has observed that they can be chained together to achieve a greater impact.

6. Periodically verify your exposed surface, not only in response to a specific alert: many incidents occur on systems that the organization itself did not know were visible from outside.

Frequently asked questions

Is it urgent?

Yes. The CVSS score is 9.4, considered critical [1], and the vulnerability is listed in CISA's KEV catalog of actively exploited vulnerabilities [2], indicating that real, documented exploitation already exists.

Do I need to have the server exposed to the internet to be at risk?

Direct exposure to the internet increases the risk, but any attacker who gains access to the internal network where the PaperCut server resides, or who can manipulate system configuration parameters, could attempt to exploit it according to the vulnerability's technical description [1].

Is it enough to just patch this vulnerability?

It is the main step, but OCIRIA recommends addressing it together with CVE-2026-81578, since both can be chained together for a greater impact. Reviewing the overall exposure of the printing infrastructure is also advisable.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-82078
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json