Risk Letters

Exploited vulnerability

CVE-2026-82078

TLP:CLEAR

PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

Facts

  • Vendor: PaperCut
  • Product: NG/MF
  • CVSS: 9.4
  • EPSS (probability of exploitation within 30 days): 63 %
  • On CISA's Known Exploited Vulnerabilities list since: 31 August 2026
  • First known exploitation: 31 August 2026
  • CISA's deadline for US federal agencies: 14 September 2026
  • Weakness: CWE-470
  • First seen by Risk Letters: 31 August 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD