PaperCut MF/NG Unsafe Dynamic Class Loading Remote Code Execution Vulnerability (CVE-2026-82078)

1. Apply Official Security Patches

Immediately upgrade to the patched version recommended in the official PaperCut security advisory.

• PaperCut Security Bulletin

2. Temporary Mitigations

If immediate patching is not feasible, implement the following controls:

• Restrict Admin Interface Access: Block external internet access to the PaperCut admin web interface (default ports 9191 and 9192). Restrict access to trusted internal IP ranges or via VPN.
• Secure Configuration Files: Restrict write permissions on configuration files (e.g., server.properties) to prevent unauthorized modification of database connection parameters.

CVE-2026-82078 is a critical unsafe dynamic class loading vulnerability (CWE-470) residing in the database connection utilities of PaperCut MF and NG.

The application instantiates database driver classes based on configurable driver names without validating them against an approved allowlist. If an attacker manipulates system configuration parameters, they can trigger the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

With a CVSS score of 9.1 and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat to unpatched deployments.