PaperCut server RCE exploited in the wild (CVE-2026-82078)

Actively exploited in the wild - CVE-2026-82078 is a critical remote code execution vulnerability in PaperCut NG and PaperCut MF versions prior to 23.0.8 that lets attackers with high-privilege configuration access execute arbitrary Java code on the print server. Patched in 23.0.8 and 22.2.8 - update immediately.

Overview

CVE-2026-82078 stems from an unsafe dynamic class loading flaw in PaperCut’s database connection utilities. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can leverage this to execute arbitrary Java bytecode already present on the application classpath, running under the security context of the PaperCut server process.

The vulnerability carries a CVSS score of 9.4 (Critical), with a network attack vector, low attack complexity, and no user interaction required. While it requires high privileges, the confirmed exploitation in the wild makes this a pressing concern for all PaperCut deployments.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the PaperCut server with the same privileges as the application service account. This can lead to:

• Full compromise of the print server and associated network resources
• Access to print queues containing sensitive documents
• Lateral movement into connected domain environments, as PaperCut often runs with elevated rights
• Persistence mechanisms via the compromised server process

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming active exploitation in real-world attacks.

Remediation

PaperCut has released patches in the following versions:

• PaperCut NG/MF 23.0.8 (and later)
• PaperCut NG/MF 22.2.8 (and later)

Immediate actions:

1. Update to a patched version immediately. No effective workaround exists for this vulnerability.
2. Audit server logs for suspicious configuration changes or unexpected class loading activity.
3. Restrict access to PaperCut configuration interfaces to trusted administrators only.
4. Consider running the PaperCut service under a least-privilege account if not already configured.
5. Review the CISA KEV catalog for additional affected product information.

For ongoing threat intelligence, refer to our security news and breach reports sections.

Security Insight

This vulnerability illustrates a recurring pattern in enterprise software: configuration-driven class loading without strict allowlisting remains a dangerous anti-pattern, echoing similar flaws found in Java application servers and database middleware over the past decade. The high CVSS score despite the privileges required suggests that in real-world PaperCut deployments, the “high privilege” barrier is often lower than assumed, given that many organizations grant broad access to print administrators. The confirmed in-the-wild exploitation should prompt a broader review of how configuration changes are monitored and audited in your print infrastructure, as the attack surface here is the management plane, not the exposed network interfaces.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs