CVE-2026-82078: PaperCut MF RCE Vulnerability

CVE-2026-82078 Overview

CVE-2026-82078 is an unsafe dynamic class loading vulnerability [CWE-470] in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist. Attackers who can manipulate system configuration parameters can trigger execution of arbitrary Java bytecode already present on the application classpath. The code runs under the security context of the PaperCut server process. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.

Critical Impact
Attackers with configuration access can achieve arbitrary Java code execution on the PaperCut server, leading to full compromise of the print management infrastructure.

Affected Products

PaperCut MF (all versions prior to the 27 August 2026 security advisory fix)
PaperCut NG (all versions prior to the 27 August 2026 security advisory fix)
Deployments exposing configuration interfaces to authenticated users

Discovery Timeline

2026-08-27 - PaperCut publishes urgent security advisory and patch
2026-08-28 - CVE-2026-82078 published to NVD
2026-09-01 - Last updated in NVD database
2026-09-03 - EPSS scoring data recorded for the CVE

Technical Details for CVE-2026-82078

Vulnerability Analysis

The vulnerability resides in PaperCut's database connection utilities. PaperCut reads the JDBC driver class name from configuration and passes it directly to Java's dynamic class loading mechanism. No allowlist restricts which classes the loader accepts. Any class already on the PaperCut server classpath becomes a valid instantiation target.

An attacker who can write to the driver configuration parameter can point PaperCut at an arbitrary class. When the server initializes a database connection, the Java Virtual Machine loads and instantiates that class. Static initializers and constructors execute as part of instantiation, giving the attacker code execution inside the PaperCut process.

The issue is classified as [CWE-470]: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). Because PaperCut typically runs with elevated privileges to manage print jobs across an environment, successful exploitation compromises the entire print management server and any credentials it holds.

Root Cause

The root cause is missing input validation on the JDBC driver class name. The database utility layer trusts the configured value and invokes reflection-based class loading without cross-checking against an approved set of driver classes.

Attack Vector

Exploitation requires network access to the PaperCut administrative interface and privileges sufficient to modify database configuration parameters. An attacker with high privileges, stolen administrator credentials, or a chained privilege escalation can set a malicious driver class name. The next database connection attempt triggers execution. A Metasploit module referenced in the Rapid7 metasploit-framework repository automates this exploitation path.

Because no verified proof-of-concept code is published outside the vendor and Metasploit references, defenders should treat the PaperCut Security Advisory and the Metasploit pull request as the authoritative technical sources.

Detection Methods for CVE-2026-82078

Indicators of Compromise

Unexpected changes to PaperCut database driver configuration parameters, especially class names that do not match approved JDBC drivers such as org.postgresql.Driver or com.microsoft.sqlserver.jdbc.SQLServerDriver.
New child processes spawned by the PaperCut server process (pc-app.exe, app-server) that do not correspond to normal print workflow activity.
Outbound network connections from the PaperCut server to unfamiliar hosts shortly after configuration changes.
PaperCut application logs referencing ClassNotFoundException or InstantiationException for atypical class names, indicating exploitation attempts.

Detection Strategies

Baseline the expected JDBC driver class name for each PaperCut deployment and alert on any deviation.
Monitor administrative login events to PaperCut and correlate them with subsequent configuration changes.
Inspect PaperCut audit logs for modifications to config.properties or equivalent database connection settings.

Monitoring Recommendations

Forward PaperCut application and audit logs to a centralized log platform for retention and correlation.
Monitor the PaperCut server host for anomalous process creation, file writes to temp directories, and unexpected network egress.
Track administrator account usage patterns and alert on off-hours configuration changes.

How to Mitigate CVE-2026-82078

Immediate Actions Required

Apply the fixed PaperCut MF or NG build referenced in the 27 August 2026 security advisory without delay.
Rotate credentials for all PaperCut administrator accounts and any service accounts stored on the server.
Restrict network access to the PaperCut administrative interface to trusted management networks and jump hosts.
Review PaperCut configuration and audit logs for signs of prior tampering with database driver settings.

Patch Information

PaperCut released fixed versions alongside the PaperCut Security Advisory (27 August 2026). CISA lists this CVE in the Known Exploited Vulnerabilities Catalog, which mandates federal remediation and signals urgency for private-sector defenders.

Workarounds

Where immediate patching is not possible, block external access to the PaperCut admin interface at the network perimeter and firewall.
Enforce multi-factor authentication on all PaperCut administrator accounts to raise the bar for credential-based abuse.
Disable or remove any unused administrator accounts and audit remaining accounts for least-privilege configuration.

bash

# Example: restrict PaperCut admin interface (default TCP/9191, 9192) to a management subnet
iptables -A INPUT -p tcp -m multiport --dports 9191,9192 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 9191,9192 -j DROP