PaperCut NG/MF Vulnerability CVE-2026-82078 Exploited in the Wild
- Severity
- HIGH
- Affected component
- papercut (other)
- Patched version
- Not yet available
Malicious actors are exploiting a security flaw in PaperCut NG and MF to execute arbitrary code. Users of PaperCut NG and MF are advised to upgrade to the latest version.
What happened
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances. PaperCut Software released a fresh emergency fix with additional hardening. The vulnerability, tracked as CVE-2026-82078, allows an unauthenticated attacker to execute arbitrary Java code inside the application's process. Specifically, an attacker can leverage an unauthenticated request to make changes to the server configuration and ultimately achieve code execution.
The exploitation of this vulnerability involves chaining two flaws. The first flaw allows an attacker to bypass authentication, and the second flaw enables remote code execution on vulnerable PaperCut NG and MF print management servers. PaperCut Software has released two sets of emergency patches to address the vulnerabilities and published indicators of compromise to help defenders block ongoing attacks.
What to do about it
- Upgrade to the latest version of PaperCut NG and MF to mitigate the risk of exploitation.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
- Implement additional security measures to protect against potential exploitation, such as network segmentation and access controls.
- Conduct a security audit of your PaperCut NG and MF instances to identify any potential vulnerabilities or misconfigurations.
- Stay informed about the latest security threats and vulnerabilities by following trusted cybersecurity news sources.
How 0Day would have caught this
papercut is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using PaperCut NG or MF, you may be affected by this vulnerability. Consult the primary sources for more information on the affected versions and patches.
What should I do right now?
Upgrade to the latest version of PaperCut NG and MF to mitigate the risk of exploitation. Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
Has this been exploited in the wild?
Yes, this vulnerability has been exploited in the wild. Malicious actors are actively exploiting this flaw to execute arbitrary code on susceptible instances.