EXPOSURES › CVE-2026-82078
CVE-2026-82078
HIGH ⌖ ON CISA KEV · EXPLOITEDPaperCut NG/MF's unsafe reflection flaw lets attackers execute arbitrary Java bytecode on the server, enabling configuration manipulation and arbitrary code execution.
The vulnerability allows an attacker to execute arbitrary Java bytecode under the PaperCut server process, directly enabling remote code execution and system compromise. DIB organizations must patch this immediately as it is actively exploited in the wild and can be chained with other CVEs to escalate privileges or exfiltrate data. Failure to patch exposes the organization to full server takeover and violates CMMC/NIST 800-171 requirements for timely patch management.
Shame score — An unsafe reflection vulnerability that enables arbitrary code execution is actively exploited in the wild and can be chained with other flaws, representing a severe, avoidable failure in secure coding and patch management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.