What Happened (Plain English)
High-risk PaperCut PaperCut MF/NG weakness requires patching (CVE-2026-82078) affects PaperCut PaperCut MF/NG. FIRST EPSS telemetry places exploitation probability at 63.05%. With a CVSS score of 9.4 (CRITICAL), security teams should verify affected deployments and prioritize remediation according to exposure.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. Unpatched internet-facing or user-accessible instances risk unauthorized execution, data exposure, or service disruption.
Affected Software & Weakness
Vendor: PaperCut · Product: PaperCut MF/NG · Versions: PaperCut MF/NG 0, PaperCut MF/NG 25.0.0, PaperCut MF/NG 26.0.0 · CWE: CWE-470
The Fix
Verify your installed PaperCut MF/NG version against PaperCut's official security bulletin for CVE-2026-82078, apply the patched build in a staging ring first when possible, and confirm rollout across all production nodes.
Temporary Workarounds
If patching PaperCut PaperCut MF/NG cannot happen today, place management ports behind VPN or zero-trust access, restrict untrusted network ingress, and enforce multi-factor authentication on administrative sessions.
Detection & Log Checks
Inspect PaperCut MF/NG application logs, perimeter firewall denies/allows, and EDR process trees for unusual child processes or outbound connections correlated with CVE-2026-82078 (CWE-470).
Frequently Asked Questions
Is CVE-2026-82078 actively exploited?
No KEV listing yet, but EPSS exploitation probability is 63.05%.
What is the fix for CVE-2026-82078?
Upgrade PaperCut MF/NG to >= 24.1.10 (CVE-2026-82078 vendor patch).
Which PaperCut products are affected?
PaperCut PaperCut MF/NG (PaperCut MF/NG 0, PaperCut MF/NG 25.0.0, PaperCut MF/NG 26.0.0).
How urgent is patching CVE-2026-82078?
Priority queue: THIS-WEEK (CVSS 9.4, EPSS 63.05%).
Official References
Last verified: 2026-11-13 · Defensive checklist only.