CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

9.4 CRITICALEPSS 63.04%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-09-14 00:16 UTC

OverviewCVSS details

9.4CRITICALCVSS 4.0

Score source: PaperCut (CNA)
NVD status: Analyzed
Published: Aug 28, 2026
Assigner: PaperCut

Affected

PaperCut MF/NG (PaperCut)

Versions: before 24.1.10 · 25.0.0 before 25.0.13
Fixed in: 24.1.10, 25.0.13, 26.0.5

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Aug 31, 2026
KEV due date: Sep 14, 2026
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

63.04%chance of exploitation in 30 days

Higher than 99.20% of CVEs

CVSS 4.0 · PaperCut (CNA)

9.4Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): High
Integrity (other systems): High
Availability (other systems): High

CVSS 3.1 · NVD

9.1Critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.4	CRITICAL	4.0PaperCut (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
9.1	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Sep 14, 2026

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Details

CVE ID: CVE-2026-82078
Status: Analyzed
Assigner (CNA): PaperCut
Published: Aug 28, 2026
Last modified: 2026-09-14 00:16 UTC
Weaknesses: CWE-470 · Use of Externally-Controlled input to select classes or code ('unsafe reflection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:07 UTC.