CVE-2026-82078

PaperCut MF/NG can be tricked into loading the “database driver” it’s told to use. If an attacker can change that setting, they may be able to load a malicious Java class instead of a legitimate driver—like swapping the engine a car is supposed to start with, and then letting the attacker drive it. Because this can lead to arbitrary code execution, it can result in total compromise of the server running PaperCut.

This matters if your business uses PaperCut MF/NG to manage printing/authentication and you have a PaperCut server reachable from the network. It becomes a real risk when attackers can modify PaperCut system configuration parameters related to the database connector driver name—reports describe exploitation that includes unauthenticated requests to change server configuration. End-to-end exposure depends on whether the attacker can reach the relevant server functionality and successfully alter configuration; the core requirement is access to change those specific database connector driver settings.

This is a RED issue because active exploitation has been reported in the wild, including cases that involved changing server configuration and executing arbitrary Java code. That means attackers are already using this weakness, not just theorizing about it. Treat it as an immediate patch/lockdown priority for any PaperCut MF/NG deployment you operate.

1. Confirm your PaperCut MF/NG version

• Locate the PaperCut MF/NG version running on the print management server (from the PaperCut admin interface or server documentation).
• Determine which fixed line applies:
  • If you’re on the 24.x line, you must be on 24.1.10 or later.
  • If you’re on the 25.x line, you must be on 25.0.13 or later.
  • If you’re on the 26.x line, you must be on 26.0.5 or later.

2. Check for active/previous exploitation indicators

• Look for recent, unexpected changes to PaperCut configuration involving database connector driver settings (especially the driver name).
• Review application/server logs around the time of any changes or errors related to database connectivity and driver loading.
• Check for unusual Java class-loading or exceptions that correlate with configuration updates.

3. Upgrade to a fixed version (primary remediation)

• Upgrade PaperCut MF/NG to the fixed version for your branch (24.1.10 / 25.0.13 / 26.0.5).
• If you manage multiple PaperCut instances, prioritize the ones with the highest exposure to the network and those used for the broadest set of users/printers.

4. Reduce the chance configuration can be changed by an attacker

• Ensure only trusted administrators can change PaperCut system configuration parameters related to the database connector driver name/driver settings.
• Confirm that any management interfaces are not publicly exposed unless explicitly intended and protected.
• Apply network controls so only required IPs/users can access PaperCut administrative or configuration-changing endpoints.

5. If patching is delayed

• Make configuration changes tightly restricted (role-based access and administrative control), and ensure the configuration interface cannot be reached by unauthorized parties.
• Consider temporarily limiting network access to PaperCut’s administrative functionality to known management hosts/IPs.

6. What to monitor after upgrading

• Ongoing logs for new configuration changes to database connector driver settings.
• Any repeated driver-load failures or suspicious errors tied to class loading.

Note on timing:

• No CISA due date was provided because KEV is not listed.
• Based on the reports, exploitation is currently observed, so prioritize the upgrade as soon as maintenance windows allow.

CVE-2026-82078 is a CWE-470 (unsafe dynamic class loading) vulnerability in PaperCut MF/NG database connector utilities. The mechanism is that PaperCut instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. If an attacker can modify the relevant system configuration parameters, they can cause the application to load malicious Java classes present on the application classpath, leading to arbitrary code execution under the PaperCut server process context. Findings indicate exploitation in the wild with active incidents and emergency patching, including reports of unauthenticated requests that could modify server configuration and bypass initial fixes. KEV is not listed in CISA KEV, and no public exploit code is on record.