CVE-2026-82078

Executive Summary

CVE-2026-82078 is a critical unsafe dynamic class loading vulnerability in PaperCut MF and PaperCut NG's database connection utilities, resulting from the application instantiating database driver classes based on configurable driver names without validating against an allowlist of approved drivers. An attacker with the ability to manipulate system configuration parameters can achieve arbitrary Java bytecode execution in the security context of the PaperCut server process, leading to full system compromise. The vulnerability carries a CVSS score of 9.1 and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-09-14, indicating active exploitation in the wild.

Technical Analysis

The vulnerability resides in the database connection utilities of PaperCut MF and PaperCut NG. The underlying flaw is an unsafe dynamic class loading issue classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, aka "unsafe reflection").

Mechanism: The application reads database driver names from configurable system parameters. When establishing database connections, it instantiates Java classes corresponding to these driver names without validating them against a predefined allowlist of approved drivers. Because Java's class loading mechanism resolves names to classes on the application classpath, an attacker who can modify configuration values to reference a malicious class — or a legitimate class whose constructor/static initializer has side effects — can cause the PaperCut server to load and execute arbitrary Java bytecode.

Attack Surface: The vulnerability is network-accessible (AV:N) but requires high privileges (PR:H) — specifically, the ability to modify system configuration parameters within PaperCut. This typically means an attacker needs an administrative account on the PaperCut application, or must chain this vulnerability with another flaw that permits configuration manipulation (e.g., a separate authentication bypass or an exposed administrative API). The attack has no user interaction requirement (UI:N) and impacts systems beyond the PaperCut server itself (S:C), meaning the confidentiality, integrity, and availability impact extends to other systems on the network.

Technical Detail Limitations: The NVD description does not specify the exact configuration parameter names, the Java class loading mechanism used (e.g., Class.forName() vs. ClassLoader.loadClass()), or the specific affected code paths. Insufficient technical detail is available to enumerate the exact methods or configuration keys involved. The attack mechanism is understood at the class level: externally-controlled driver names feed into a dynamic class instantiation routine without allowlist enforcement, resulting in arbitrary code execution.

Notable Context: The EPSS score of 0.00462 places this vulnerability in the 38.3rd percentile of exploited CVEs, indicating moderate exploitation likelihood. However, its presence on the CISA KEV list confirms that exploitation has been observed in the wild, making the EPSS score an under-prediction in this case.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The attack chain is inferred from the vulnerability class (unsafe dynamic class loading / CWE-470).

Step 1 — Reconnaissance and Target Identification: An attacker identifies internet-facing PaperCut MF or NG servers. Standard fingerprinting techniques include checking HTTP response headers, login page banners, or known default paths associated with PaperCut administration interfaces. Shodan-style searches for "PaperCut" in server titles or HTTP bodies can identify targets. The attacker determines whether the host is running a vulnerable version and whether the administrative interface is exposed to the network.

Step 2 — Gaining Configuration Manipulation Privileges: The attacker must obtain the ability to modify system configuration parameters. Given the PR:H requirement, this likely involves one of the following:

• Compromising an administrative account (local admin or domain admin with PaperCut admin rights) via credential stuffing, password spraying, or phishing.
• Chaining this vulnerability with a separate pre-auth flaw (e.g., a session fixation or authentication bypass) to reach the configuration interface without legitimate credentials.
• Exploiting a misconfigured administrative API endpoint that accepts configuration changes without proper authorization.

Step 3 — Triggering the Flaw: Once configuration access is obtained, the attacker modifies the database driver configuration parameter, replacing the legitimate driver name with a reference to a malicious class or a class that executes attacker-controlled code during instantiation. The payload class must already reside on the application classpath — either pre-planted via another file upload vector, or referenced from an existing library with dangerous side effects. The attacker then forces the application to re-establish a database connection (e.g., by restarting the database connection pool, restarting the service, or triggering a connection retry), causing the application to instantiate the attacker-specified driver class. At this point, arbitrary Java bytecode executes under the security context of the PaperCut server process.

Step 4 — Post-Exploitation Impact: With arbitrary code execution in the PaperCut server process, the attacker gains complete control of the PaperCut server. Given that PaperCut servers commonly run with elevated privileges (often as a service account with broad filesystem access, and in some deployments with local administrator rights), the attacker can:

• Extract database credentials and access the underlying print management database.
• Move laterally to connected systems (print servers, domain controllers in some configurations).
• Deploy persistent backdoors, ransomware, or other malware.
• Disrupt print services across the organization, causing operational denial of service.
• Use the PaperCut server as a pivot point for deeper network compromise.

Since the CVSS vector indicates scope change (S:C), the compromise impacts systems beyond the PaperCut server itself, potentially including the entire organizational network.

Impact Assessment

Business Impact: PaperCut is a print management solution widely deployed in educational institutions, enterprises, and government organizations. A compromise of the PaperCut server can result in:

• Confidentiality breach (C:H): Access to print job data, user credentials, database contents, and potentially sensitive documents routed through the print system.
• Integrity compromise (I:H): Modification of print queues, billing configurations, user quotas, and system files.
• Availability loss (A:H): Disruption of print services across the entire organization, with potential for ransomware deployment that encrypts the server and connected systems.

Affected Systems and Blast Radius: All PaperCut MF and PaperCut NG installations with exposed administrative interfaces or reachable configuration mechanisms are at risk. The scope change (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component, meaning compromised PaperCut servers can be leveraged to attack other systems in the network — particularly print servers, domain controllers (if the PaperCut service account has domain privileges), and any system reachable from the PaperCut host.

CVSS Score Rationale (9.1 — Critical):

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: Low (AC:L) — no complex conditions required beyond configuration access
• Privileges Required: High (PR:H) — requires configuration modification capability
• User Interaction: None (UI:N) — no user action needed
• Scope: Changed (S:C) — impact extends beyond the vulnerable component
• Confidentiality/Integrity/Availability: High/High/High (C:H/I:H/A:H) — complete compromise

Exploitation in the Wild: CISA KEV inclusion confirms active exploitation. The remediation deadline of 2026-09-14 imposes a hard timeline for federal agencies and is a strong signal for all organizations to prioritize patching.

Severity Justification: The combination of remote exploitability, high operational impact on print infrastructure (which is business-critical in many organizations), and confirmed in-the-wild exploitation warrants immediate attention.

Detection Guidance

Sigma Rule

title: PaperCut Unsafe Dynamic Class Loading - Config Modification Attempt
id: 8f3a1c2e-5d4b-4a9f-8c2e-7b1d3a9f4c5e
status: experimental
description: Detects attempts to modify PaperCut database driver configuration parameters, potentially indicating exploitation of CVE-2026-82078 (unsafe dynamic class loading)
author: Valters IT Security Team
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        key: '/etc/papercut/'
    keywords:
        - 'driver'
        - 'connection'
        - 'jdbc'
        - 'database'
    condition: selection and keywords
level: high
falsepositives:
    - Legitimate administrative changes to database configuration by IT staff
    - Routine database driver updates
fields:
    - user
    - process.name
    - process.executable
tags:
    - attack.t1190
    - attack.execution
    - cve.2026-82078

YARA Rule

rule PaperCut_Unsafe_ClassLoading_CVE_2026_82078 {
    meta:
        author = "Valters IT Security Team"
        description = "Detects strings associated with PaperCut database driver configuration manipulation for CVE-2026-82078"
        cve = "CVE-2026-82078"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $s1 = "database.driver" ascii wide nocase
        $s2 = "jdbc.driver" ascii wide nocase
        $s3 = "connection.driver" ascii wide nocase
        $s4 = "db.driver" ascii wide nocase
        $s5 = "Class.forName" ascii wide nocase
        $s6 = "driverClassName" ascii wide nocase
        $s7 = ".jar" ascii wide nocase
        $s8 = "papercut" ascii wide nocase
    condition:
        any of ($s1,$s2,$s3,$s4,$s5,$s6) and $s8 and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-82078 PaperCut Configuration Manipulation Attempt"; flow:established,to_server; content:"POST"; http_method; content:"driver"; http_client_body; nocase; content:"jdbc"; http_client_body; nocase; content:"papercut"; http_uri; nocase; reference:cve,2026-82078; classtype:attempted-admin; sid:2026820781; rev:1;)

Elastic Detection

REAL ELASTIC EQL RULE (verified from elastic/detection-rules — reproduce EXACTLY):

process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR index=linux sourcetype=linux_audit
  (EventCode=4688 OR type=EXECVE OR type=PATH)
  AND (user=*admin* OR process.privileges=*admin*)
  AND (process_name=java.exe OR process_name=java OR process_name=javaw.exe)
  AND (command_line=*driver* OR command_line=*jdbc* OR command_line=*connection*)
  OR (
    index=windows sourcetype=WinEventLog:Security EventCode=4688
    AND parent_process_name=("pc-app.exe" OR "pc-printjob-spooler.exe")
    AND process_name=("cmd.exe" OR "powershell.exe" OR "pwsh.exe" OR "wscript.exe" OR "cscript.exe")
  )
  OR (
    index=linux sourcetype=linux_audit type=PATH
    AND path=*/etc/papercut/*
    AND name=*driver*
  )
| table _time, user, host, process_name, parent_process_name, command_line, path
| sort -_time

Wazuh OSSEC Rule

<group name="papercut,cve-2026-82078,">
  <rule id="100281" level="15">
    <if_sid>510</if_sid>
    <match>papercut</match>
    <regex>driver|jdbc|connection</regex>
    <description>PaperCut configuration modification detected - possible CVE-2026-82078 exploitation</description>
    <group>attack.t1190,execution,critical</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100282" level="15">
    <if_sid>5710</if_sid>
    <match>java</match>
    <regex>Class.forName|getClass|loadClass</regex>
    <description>PaperCut Java process performing dynamic class loading - suspicious activity indicator for CVE-2026-82078</description>
    <group>attack.t1190,execution,critical</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch; not independently confirmed). The NVD indicates a patch exists, but no specific vendor advisory, version number, or patch details have been provided. Organizations should verify patch availability directly with PaperCut.

Immediate Mitigations (Days 0–7):

1. Restrict network access to PaperCut administrative interfaces. If the admin console and configuration API are not required to be internet-facing, block external access immediately. Limit exposure to trusted internal networks or VPNs only.
2. Enforce multi-factor authentication on all PaperCut administrative accounts. Given the PR:H requirement, strong authentication for admin users significantly raises the bar for exploitation.
3. Audit existing administrative accounts. Remove or disable dormant accounts, enforce least-privilege principles, and reset credentials for all admin-level accounts.
4. Monitor for in-the-wild exploitation. Correlate CISA KEV notification with logs; review any anomalous configuration changes or database connection activity since 2026-09-14.
5. If patching is not immediately possible and exposure is unavoidable, consider taking affected servers offline or isolating them from the network until a patch is confirmed.

Patch/Upgrade Steps:

1. Verify patch availability with PaperCut support or official advisory channels. Since patch confirmation is limited (2/4 confidence), do not assume a patch exists without verification.
2. If a patch is available, test it in a staging environment that mirrors production configuration, including database connectivity and driver specifications.
3. Deploy the patch across all PaperCut MF and NG instances. Prioritize internet-exposed servers first.
4. After patching, verify that database driver configuration is locked down to approved drivers only and that the allowlist validation is functioning.
5. Re-run a full vulnerability scan to confirm CVE-2026-82078 is remediated.

Long-Term Hardening:

1. Implement network segmentation. PaperCut servers should reside in a dedicated zone with strictly controlled inbound and outbound traffic.
2. Run PaperCut with least-privilege service accounts. The service account should not have domain admin rights or broad filesystem access beyond what is required for print management.
3. Deploy file integrity monitoring on PaperCut installation directories and configuration files to detect unauthorized modifications to driver configuration parameters.
4. Establish a config-change approval workflow that requires dual authorization for database connection parameter changes.
5. Maintain an up-to-date asset inventory of all PaperCut instances to ensure comprehensive patching.
6. Subscribe to vendor security advisories and CISA KEV updates for future known-exploited vulnerabilities affecting similar products.
7. Implement application-level allowlist controls at the Java class-loading layer, if feasible, to prevent dynamic instantiation of classes outside approved drivers.

References

1. NVD — CVE-2026-82078: https://nvd.nist.gov/vuln/detail/CVE-2026-82078
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (PaperCut NG/MF Unsafe Reflection Vulnerability, remediate by 2026-09-14)
3. CWE-470 — Use of Externally-Controlled Input to Select Classes or Code: https://cwe.mitre.org/data/definitions/470.html
4. PaperCut Security Advisories (official vendor channel): https://www.papercut.com/support/security/ (verify patch availability)
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-Wild Evidence: CISA KEV listing confirms active exploitation. No specific threat actor campaigns, exploit samples, or proof-of-concept code are publicly documented at this time. The lack of public PoC does not diminish the threat — the vulnerability class is well-understood and actively targeted in enterprise environments given the widespread deployment of PaperCut print management solutions.