Severity: Critical (CVSS 9.4) & High (CVSS 8.8)

Status: Patched — update immediately

1. Summary
2. Impacted versions
3. Recommendations
4. References
5. Support

Two vulnerabilities were discovered and remediated by the PaperCut security team; both have been mitigated through a released patch named “Emergency Patch Release 2”:

• CVE-2026-82078 – An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
• CVE-2026-81578 – An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

All versions of PaperCut NG/MF are impacted by these vulnerabilities.

• If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses)
• Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.
• Install the Emergency Patch Release 2, an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action. Standard updating procedure listed here.
• Check indicators of compromise and investigation guidance listed in the main PaperCut security bulletin for more info on how to check/determine if your instance of PaperCut may have been exploited using these vulnerabilities.

• PaperCut NG/MF Security Bulletin
• [NVD entry] CVE-2026-82078 detail
• [NVD entry] CVE-2026-81578 detail
• [Huntress Blog] PaperCut actively exploited: A pre-auth RCE chain

As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.