{"id":"CVE-2026-82078","published":"2026-08-28T16:18:31Z","modified":"2026-09-14T00:16:56Z","title":"PaperCut NG/MF Unsafe Reflection Vulnerability","vendor":"PaperCut","product":"NG/MF","tier":"core","eol":null,"description":{"text":"An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.","provenance":"source","from":"NVD"},"summary":{"text":"PaperCut NG and PaperCut MF contain an unsafe dynamic class loading flaw in their database connection utilities, where driver class names taken from configurable settings are instantiated without checking against an allowlist. An attacker who can manipulate system configuration parameters, which requires high privileges, can cause arbitrary Java bytecode already on the application classpath to execute under the PaperCut server process's security context, with no user interaction needed and network access sufficient to reach the configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:24Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.63047,"percentile":0.992,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-08-31","dueDate":"2026-09-14","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-08-28","exploitedFirstSeen":"2026-08-28","ransomware":false,"evidence":[{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67714","date":"2026-08-28"},{"url":"https://previdian.com/CVE-2026-82078","date":"2026-08-28"},{"url":"https://www.huntress.com/blog/papercut-actively-exploited","date":"2026-08-28"},{"url":"https://www.linkedin.com/posts/yesterday-watchtowr-rapidly-reacted-to-share-7499107361605722112-b2gE/","date":"2026-08-28"},{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","date":"2026-08-28"},{"url":"https://x.com/DefusedCyber/status/2094004924660982073","date":"2026-08-30"},{"url":"https://www.acn.gov.it/portale/w/papercut-rilevato-sfruttamento-in-rete-delle-cve-2026-82078-e-cve-2026-81578","date":"2026-08-31"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-08-31"},{"url":"https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-papercut-cve-exploitation","date":"2026-09-04"},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","date":"2026-09-08"}],"evidenceTotal":16,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Inside a PaperCut Attacker's AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries","url":"https://otx.alienvault.com/pulse/6ad9e638a49d24b258228fa3","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"PaperCut Attacker’s AI Toolkit","url":"https://otx.alienvault.com/pulse/6ad7863283d1650eef19af75","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-470","name":"Use of Externally-Controlled Input to Select Classes or Code"}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/21842","tags":["Issue Tracking","Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078","tags":["Patch","Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploit via externally reachable application config manipulation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"If an attacker can manipulate system configuration parameters","start":271,"end":332}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary bytecode execution in server process","mappingType":"primary_impact","evidence":[{"from":"description","quote":"enables the execution of arbitrary Java bytecode residing on the application classpath","start":339,"end":425}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-54da84d6e2963a55b84e","title":"Notorious Cybercrime Gang, FIN7, Lands Malware in Law Firm","publisher":"esentire.com","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc","date":null,"mentions":[{"quote":"PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078 and CVE-2026-81578)","start":2768,"end":2847},{"quote":"The vulnerabilities are CVE-2026-82078 (CVSS: 9.4) and…","start":2990,"end":3045}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-67714","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67714","exploited":true,"exploitedSince":"2026-08-27","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)","module":"exploit/multi/http/papercut_ng_external_user_lookup_rce","type":"exploit","disclosureDate":"2026-08-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"}],"first":{"date":"2026-08-27","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-08-27","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb","provenance":"source"},{"date":"2026-08-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67714","provenance":"source"},{"date":"2026-08-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82078","provenance":"source"},{"date":"2026-08-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67714","provenance":"source"},{"date":"2026-08-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3},"priority":{"score":83.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 64 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9920"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}