CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Other sources
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of PaperCut MF/NG if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be able to manipulate PaperCut system configuration parameters that control database driver names. Exploitation also requires arbitrary Java bytecode to be present on the PaperCut application classpath.
What is the impact if exploitation succeeds?
The attacker can cause arbitrary Java bytecode on the application classpath to execute under the security context of the PaperCut server process.