CISA Warns of Multiple PaperCut NG/MF Vulnerabilities Actively Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting PaperCut NG and PaperCut MF to its Known Exploited Vulnerabilities (KEV) Catalog, warning that threat actors are actively exploiting the flaws in real-world attacks.

The flaws, addressing critical PaperCut vulnerabilities tracked as CVE-2026-81578 and CVE-2026-82078, can be chained to enable unauthenticated attackers to alter server configurations and execute malicious Java bytecode under the security context of the PaperCut server process.

CISA Warns of PaperCut NG/MF Vulnerabilities

PaperCut NG and PaperCut MF are widely used print-management platforms deployed by schools, enterprises, government agencies, and managed service providers.

Their central role in managing printers, user authentication, quotas, and document workflows can make a compromised PaperCut server a valuable foothold for attackers seeking access to internal networks.

CVE-2026-81578 is a missing authentication vulnerability affecting a critical function in PaperCut NG/MF. The flaw allows an unauthenticated remote attacker to modify certain system configuration settings without first providing valid credentials.

The issue is categorized under CWE-306, which covers missing authentication for critical functions.

The second issue, CVE-2026-82078, is an unsafe reflection vulnerability categorized as CWE-470. According to the vulnerability details, an attacker can manipulate system configuration parameters and execute arbitrary Java bytecode already present on the application classpath.

Successful exploitation would run the code within the security context of the PaperCut server process, potentially giving an attacker the same level of access and permissions held by that service.

The most serious risk emerges when the two flaws are combined. An attacker could first exploit CVE-2026-81578 to alter configurations without authentication, then use CVE-2026-82078 to invoke malicious behavior through unsafe reflection.

This chaining possibility may allow remote compromise of a vulnerable PaperCut deployment, making internet-exposed management interfaces especially important to identify and secure.

As cataloged in the official CISA KEV Catalog, CISA added both vulnerabilities to the listing on August 31, 2026, and set a remediation deadline of September 14, 2026, for U.S. federal civilian executive branch agencies.

CISA’s inclusion of a vulnerability across KEV catalog additions indicates exploitation in the wild, even though the agency’s entries list ransomware use as unknown for both flaws.

Organizations running PaperCut NG or MF should promptly review vendor guidance and apply available mitigations.

Security teams should prioritize systems exposed to the internet, verify that administrative interfaces are not unnecessarily reachable from public networks, and assess whether the PaperCut service is running with excessive privileges.

Where patches or mitigations cannot be applied, CISA advises organizations to follow applicable risk-based guidance for cloud services or discontinue use of the affected product.

Administrators should also review PaperCut server logs, authentication events, configuration-change records, and unusual Java process activity for signs of unauthorized access.

Although CISA does not currently require forensic triage under BOD 26-04 for either CVE, the potential for chained exploitation warrants proactive investigation in environments where vulnerable instances may have been externally accessible.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post CISA Warns of Multiple PaperCut NG/MF Vulnerabilities Actively Exploited in Attacks appeared first on Cyber Security News.