CVE-2026-82078 · Moderate · CISA KEV

PaperCut NG/MF Unsafe Reflection Vulnerability Allows System Configuration Manipulation

Threat Engine Auto-Feed · data current as of 2026-08-31

A critical unsafe reflection vulnerability in PaperCut NG/MF allows attackers to manipulate system configuration and execute arbitrary Java bytecode. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA KEV. While a PoC is not publicly available, its exploitation has been observed.

  • CVSS:
  • EPSS percentile: 0.38255
  • Exploitation pressure: 48/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 38th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability, an 'unsafe reflection' issue, means that the software uses a programming technique called 'reflection' in an insecure way. Reflection allows a program to inspect and modify its own structure and behavior at runtime. When used unsafely, an attacker can trick the program into executing malicious code or altering critical settings that it shouldn't be able to access, effectively bypassing security controls.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using PaperCut NG/MF for print management, especially those with extensive internal networks or sensitive data.
  • Financial services and Technology sectors, due to documented targeting by relevant threat actors.

Misconfigurations that escalate it

  • Lack of network segmentation that would prevent an attacker from reaching the PaperCut server.
  • Insufficient monitoring of PaperCut server logs for unusual activity or configuration changes.

High-impact scenarios

  • An attacker gaining full control over the PaperCut server, leading to arbitrary code execution within the server's security context.
  • Manipulation of system configuration parameters, potentially disrupting print services or enabling further lateral movement within the network.
  • Chaining this vulnerability with CVE-2026-81578 for escalated impact, potentially leading to broader system compromise.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor PaperCut NG/MF server logs for unusual configuration changes or unexpected Java bytecode execution.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns to and from PaperCut servers.
  • Regularly review system integrity of PaperCut installations for unauthorized file modifications.

Contain

  • Isolate affected PaperCut NG/MF servers from the broader network if compromise is suspected.
  • Restrict network access to PaperCut servers to only essential services and personnel.
  • Implement strong access controls and least privilege principles for accounts interacting with PaperCut.

Patch

  • Apply vendor-provided security updates for PaperCut NG/MF immediately upon release to address CVE-2026-82078.

Frontier verdict — Moderate

High priority due to active exploitation in the wild (CISA KEV) and potential for arbitrary code execution and system configuration manipulation.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.