CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Enables Arbitrary Java Bytecode Execution

Background

PaperCut NG and PaperCut MF are print management software platforms widely deployed by enterprises, schools, government agencies, and healthcare organizations to track, control, and bill print jobs across an organization’s fleet of printers and multifunction devices. The PaperCut server component runs as a Java application and typically has broad network visibility into an organization’s print infrastructure, along with administrative hooks into user accounts, cost centers, and device configuration.

PaperCut has a notable history in vulnerability research: a prior pair of CVEs (CVE-2023-27350 and CVE-2023-27351, both covered elsewhere on this site) were exploited at scale, including by ransomware-affiliated actors, to achieve unauthenticated remote code execution against PaperCut servers. CVE-2026-82078 is a distinct, newer vulnerability in the same product line, and — notably — the KEV record states it can be chained with CVE-2026-81578, indicating this is part of a related vulnerability cluster rather than an isolated bug.

Technical Mechanism

CVE-2026-82078 is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — “Unsafe Reflection”). The KEV shortDescription states that the flaw “allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.”

Unsafe reflection vulnerabilities occur when an application uses Java’s reflection APIs (such as Class.forName() combined with instantiation or method invocation) to dynamically load and execute code, and the class name, method name, or related parameter used to drive that reflection call is derived from attacker-controllable input rather than a fixed, trusted value. The attack flow for this class of vulnerability typically works as follows:

1. PaperCut NG/MF exposes one or more configuration parameters that are processed by server-side code using Java reflection to dynamically resolve and instantiate classes or invoke methods — likely as part of a plugin, extension, or configuration-driven feature that was designed for flexibility.
2. An attacker who can manipulate these configuration parameters — potentially through an exposed admin interface, API endpoint, or another vector depending on the specific access this CVE requires — supplies a value that references a class already present on the PaperCut server’s Java classpath.
3. Rather than loading a class the application developers intended, the reflection call loads and executes a class of the attacker’s choosing, constrained only by what classes are available on the classpath (including PaperCut’s own bundled libraries and the broader JRE).
4. Because this executes “under the security context of the PaperCut server process,” the resulting code execution inherits whatever privileges that process runs with on the host — commonly significant system access given PaperCut’s administrative role in print infrastructure.
5. The explicit note that this can be chained with CVE-2026-81578 suggests that the full attack path to unauthenticated, remote exploitation may involve first using CVE-2026-81578 (for example, to gain the access or configuration-manipulation capability) before CVE-2026-82078 is used to convert that into arbitrary code execution — mirroring the chaining pattern seen in the earlier CVE-2023-27350/27351 PaperCut vulnerabilities.

Real-World Exploitation Evidence

CVE-2026-82078 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-08-31. KEV listing confirms CISA has verified active, real-world exploitation of this vulnerability.

Regarding ransomware: the KEV record lists knownRansomwareCampaignUse as “Unknown.” CISA has not confirmed use of this specific vulnerability in ransomware campaigns at this time. This is a meaningful distinction from PaperCut’s earlier CVE-2023-27350/27351 pair, which was confirmed to be used by ransomware-affiliated actors (including Bl00dy and Cl0p-linked activity) — no such confirmed link exists yet for CVE-2026-82078 based on the data available.

No specific threat actor, intrusion set, or campaign name has been publicly attributed to exploitation of this CVE in the data available at the time of writing. Its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Given PaperCut’s documented history as a target for financially motivated and ransomware-affiliated actors, organizations should treat the “Unknown” ransomware status as a current reporting gap rather than a durable assurance, and should remediate with the same urgency as the earlier, confirmed-ransomware-linked PaperCut CVEs.

Impact Assessment

A CVSS score of 9.1 at the critical tier reflects a severe compromise with broad confidentiality, integrity, and availability consequences.

What an attacker achieves:

• Arbitrary code execution: The ability to execute arbitrary Java bytecode under the PaperCut server process’s security context is, for practical purposes, full remote code execution — an attacker can run any logic available on the server’s classpath, including file system access, network connections, and process spawning (depending on the JVM’s permissions and any sandboxing in place).
• Confidentiality: Access to print job metadata, user account information, cost-center and billing data, and potentially credentials stored or cached by the PaperCut server for integration with directory services (LDAP/Active Directory) or print device management.
• Integrity: The ability to modify print management configuration, user permissions, and potentially leverage PaperCut’s administrative reach into connected print devices.
• Lateral movement: Because PaperCut servers typically run with domain-joined or directory-integrated accounts to manage user print quotas and authentication, a compromised PaperCut host can be a stepping stone toward broader Active Directory or internal network compromise — this was precisely the pattern seen in ransomware intrusions that began with the earlier PaperCut CVEs.

Sector-specific risk: PaperCut is heavily deployed in education (K-12 and higher education print labs), healthcare (clinical and administrative printing), and government/public sector environments — all sectors where the prior PaperCut CVE-2023-27350/27351 exploitation wave caused significant, publicly documented ransomware incidents. Organizations in these sectors should treat this CVE with the same urgency given the demonstrated real-world consequences of unpatched PaperCut servers.

Affected Versions

The KEV record does not specify exact affected version ranges in the fields provided. PaperCut’s security bulletin dated 27 August 2026 is the authoritative source for version-level detail.

Organizations should consult PaperCut’s security bulletin (27 August 2026) for the definitive list of affected product versions, including whether the related CVE-2026-81578 affects the same version range, as the KEV data supplied does not enumerate specific version boundaries.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, in compliance with BOD 26-04 and its Forensics Triage Requirements.

1. Apply PaperCut’s security patch described in the 27 August 2026 urgent security advisory to all affected PaperCut NG/MF servers immediately — and ensure the fix for the chainable CVE-2026-81578 is applied in the same maintenance window, since the two can be combined into a single attack chain.

   # Example — verify current PaperCut application server version before/after patching
   # Server > About > Version, or check the application server's build info page

2. Restrict network access to the PaperCut application server’s administrative interfaces to trusted management networks only, as a defense-in-depth measure while patching is completed.
3. Review configuration parameters that may have been exposed to reflection-based manipulation for any unexpected or unrecognized values, which could indicate prior exploitation attempts.
4. Conduct forensic triage on any internet-facing or otherwise exposed PaperCut instance unpatched prior to 2026-08-31, per BOD 26-04 Forensics Triage Requirements — given the historical pattern of ransomware actors using PaperCut compromise as an initial-access vector, triage should extend to checking for lateral-movement artifacts, not just the PaperCut host itself.
5. Rotate service account and directory-integration credentials used by the PaperCut server if forensic review cannot rule out prior unauthorized code execution.
6. Discontinue use of the product if mitigation cannot be applied in time, per BOD 26-04 guidance for assets that cannot be promptly secured.

Detection Guidance

Exact IOCs specific to this CVE have not been published in the data available; the following detection strategies are appropriate for an unsafe-reflection RCE vulnerability in a Java-based print management server:

• PaperCut application logs: Review for unexpected configuration parameter changes, especially values that resemble fully-qualified Java class names rather than expected configuration values.
• Process monitoring on the PaperCut host: Watch for the PaperCut server process (typically a Java process) spawning unexpected child processes, loading unusual classes, or making unexpected file system or network access — consistent with the pattern seen in the earlier, confirmed PaperCut RCE campaigns.
• Outbound network connections: Monitor for the PaperCut server host initiating connections to unfamiliar external IPs, which would be anomalous for a print management server’s expected traffic pattern and could indicate payload download or command-and-control activity.
• Authentication and lateral-movement indicators: Given PaperCut’s directory-service integration, monitor Active Directory/LDAP authentication logs for anomalous activity originating from service accounts associated with the PaperCut server following any suspected exploitation window.

Because specific signatures for this CVE’s exploitation have not been publicly detailed, organizations should prioritize patching and applying the detection lessons from the earlier, well-documented PaperCut RCE incidents, while monitoring vendor and IDS feeds for CVE-2026-82078-specific indicators as they become available.

Timeline

References

• PaperCut Security Bulletin — 27 August 2026 Urgent Security Advisory
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD — CVE-2026-82078