CVE-2026-82078
Last modified
CVE-2026-82078 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. CISA has confirmed active exploitation in the wild. EPSS estimates a 1.69% chance of exploitation in the next 30 days.
Description
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Papercut | Papercut Mf | < 24.1.9 |
| Papercut | Papercut Mf | >= 25.0.2, < 25.0.12 |
| Papercut | Papercut Mf | >= 26.0.2, < 26.0.4 |
| Papercut | Papercut Ng | < 24.1.9 |
| Papercut | Papercut Ng | >= 25.0.2, < 25.0.12 |
| Papercut | Papercut Ng | >= 26.0.2, < 26.0.4 |
References
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/Patch, Vendor Advisory
- https://github.com/rapid7/metasploit-framework/pull/21842Issue Tracking, Patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078Patch, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-82078?
How severe is CVE-2026-82078?
How do I fix CVE-2026-82078?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82071Insufficient validation of storage engine configuration opti…8.1
- CVE-2026-82072Out of bounds read in V8 in Google Chrome prior to 151.0.792…8.8
- CVE-2026-82073A security issue in the MongoDB Server aggregation framework…6.5
- CVE-2026-82074MongoDB Server contains an incorrect authorization vulnerabi…6.5
- CVE-2026-82075An uncontrolled resource consumption weakness exists in the …7.5
- CVE-2026-82076An integer overflow in the query planning component of Mongo…6.5
- CVE-2026-82079A stack-based buffer overflow vulnerability in the Nintendo …8.4
- CVE-2026-8208Gibbon versions before v30.0.01 are affected by a local file…8.9
- CVE-2026-82081wallabag 2 through 2.6.14 allows SSRF because a crafted titl…6.4
- CVE-2026-82082NUMail developed by Green-Computing has an OS Command Inject…9.8
- CVE-2026-82089The wallabag (aka fr.gaulupeau.apps.InThePoche) application …8.8
- CVE-2026-8209Gibbon versions before v30.0.01 are affected by a path trave…6.9
Are you affected by CVE-2026-82078?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST