An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF…

CVE-2026-82078 is an unsafe dynamic class-loading flaw in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates JDBC database driver classes from names stored in configuration without validating them against an allowlist. On its own, exploiting it requires the ability to edit PaperCut's configuration — but when chained with CVE-2026-81578 (CVSS 8.8, an improper access-control bypass in the web management interface), unauthenticated remote attackers can modify that configuration and then trigger the class-loading flaw to execute arbitrary Java bytecode under the PaperCut server process — which runs as SYSTEM on Windows. All versions of PaperCut NG and MF prior to August 27, 2026 are affected across Windows, Linux, and macOS. Emergency patches exist for versions 24, 25, and 26; the 47% of tracked installations still on v23 or earlier have no patch available and must upgrade.

No vendor CVSS baseline was published in a standard authority database at time of assessment. The vendor's own advisory uses the word *urgent* and assigns a 9.4 score internally. That score is fair — arguably even generous to the vendor — because the chain is pre-authentication, actively exploited in the wild as a zero-day, runs as SYSTEM, the first emergency patch was bypassed within 24 hours by watchTowr and Huntress researchers, and nearly half the install base cannot patch without a full version upgrade. This is textbook CRITICAL.

Why this verdict

• Active zero-day exploitation: Huntress confirmed attacks in customer environments before any patch existed. Attackers are already using this chain operationally — this is not theoretical.
• Pre-authentication RCE to SYSTEM: The chain requires zero credentials and zero user interaction. Any host that can reach PaperCut's web interface (port 9191/9192) can execute arbitrary code as SYSTEM. The attack surface is the network, not an authenticated session.
• Patch instability: The first emergency patch was bypassed within 24 hours by watchTowr researchers, and 47% of the install base runs versions (v23 and older) for which no patch exists at all — only a full version upgrade resolves the issue.
• Role multiplier: PaperCut Application Servers are typically domain-joined Windows servers running as SYSTEM. SYSTEM on a domain-joined host yields machine account credentials, enabling NTLM relay, Kerberos ticket harvesting, and lateral movement. In environments where PaperCut integrates with Active Directory for user/group sync (the default configuration), the server often holds or can request elevated directory credentials. The blast radius extends from host → domain, making this a fleet-compromise vector in typical enterprise deployments. This is not a workstation-class target — it is a centralized server managing print infrastructure for the entire organization.
• Exposure surface is meaningful: ~1,000 internet-facing instances per ShadowServer, and virtually every enterprise deployment is reachable from the internal LAN. Internal attacker position (post-phish, post-VPN) trivially reaches PaperCut.

Why not higher?

There is no severity above CRITICAL. A 9.4 score already reflects the maximum practical severity bucket. The only reason this is not a 10.0 is that the Availability impact in the chained scenario is partial rather than total — the server continues running while executing attacker payloads.

Why not lower?

Downgrading below CRITICAL is not defensible. The chain is pre-auth, actively exploited, runs as SYSTEM, affects all versions, the first patch was bypassed, and the target is a centralized domain-joined server. Every friction-based argument (only ~1,000 internet-facing) is negated by the fact that internal network access trivially reaches the target, and attackers are already demonstrating operational use. The role multiplier (domain-joined SYSTEM server) floors this at CRITICAL.

1. Block external access to PaperCut ports 9191/9192 immediately — Restrict PaperCut Application Server web interface to trusted internal IP ranges using firewall rules. This eliminates the internet-facing attack surface for the ~1,000 exposed instances. Deploy within the noisgate mitigation SLA of 3 days — but given active exploitation, do this today.
2. Restrict internal access to PaperCut admin interface to admin workstations only — Even behind the firewall, limit access to ports 9191/9192 to a small set of administrator source IPs via host firewall or network ACL. This reduces the internal attack surface from 'any LAN host' to a handful of jump boxes. Deploy within 3 days.
3. Deploy EDR detection rule for pc-app.exe spawning shell processes — Create a high-fidelity EDR rule alerting on pc-app.exe (Windows) or the papercut process (Linux) spawning cmd.exe, powershell.exe, bash, sh, or any child process. This detects post-exploitation even if the vulnerability is successfully exploited. Deploy within 3 days.
4. Enable file-integrity monitoring on PaperCut server/lib/ directory — Monitor for creation of unexpected .class files in the PaperCut server/lib/ directory. The attack chain requires dropping a malicious .class file here. FIM alerts provide near-real-time detection of exploitation attempts.
5. Forward PaperCut server.log to SIEM and alert on gaps — Attackers delete or truncate server.log post-exploitation. Forwarding logs to a SIEM ensures you retain evidence and can alert on log deletion or gaps. Look for jdbc:derby:memory:pwn or No suitable driver found for jdbc:no:x entries.

Run this on each PaperCut Application Server host (Windows). Execute as Administrator in PowerShell. Example: .\Check-PaperCutCVE202682078.ps1. The script checks the installed PaperCut version against known-patched build numbers and inspects for IOCs.

#Requires -RunAsAdministrator
# Check-PaperCutCVE202682078.ps1
# Checks PaperCut NG/MF for CVE-2026-82078 vulnerability and IOCs
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$status = 'UNKNOWN'
$exitCode = 2
$findings = @()

# Locate PaperCut installation
$pcPaths = @(
    'C:\Program Files\PaperCut MF',
    'C:\Program Files\PaperCut NG',
    'C:\Program Files (x86)\PaperCut MF',
    'C:\Program Files (x86)\PaperCut NG'
)

$installPath = $null
foreach ($p in $pcPaths) {
    if (Test-Path $p) { $installPath = $p; break }
}

if (-not $installPath) {
    Write-Host 'PaperCut installation not found on this host.'
    Write-Host 'UNKNOWN'
    exit 2
}

Write-Host "PaperCut found at: $installPath"

# Check version from version.txt or build.txt
$versionFile = Join-Path $installPath 'server\version.txt'
$buildFile = Join-Path $installPath 'server\build.txt'
$version = $null

if (Test-Path $versionFile) {
    $version = (Get-Content $versionFile -Raw).Trim()
    Write-Host "Version: $version"
}
if (Test-Path $buildFile) {
    $build = (Get-Content $buildFile -Raw).Trim()
    Write-Host "Build: $build"
}

# Known patched builds (Emergency Patch Release 2, Aug 28 2026)
$patchedBuilds = @(76496, 76497)

if ($build) {
    $buildNum = [int]($build -replace '[^0-9]', '')
    if ($buildNum -ge 76496) {
        $status = 'PATCHED'
        $exitCode = 0
        $findings += "Build $buildNum is at or above Emergency Patch Release 2."
    } else {
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += "Build $buildNum is BELOW Emergency Patch Release 2 (76496+)."
    }
} elseif ($version) {
    # Try to parse major version
    $major = [int]($version.Split('.')[0])
    if ($major -le 23) {
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += "Version $major has NO patch available. Upgrade required."
    } else {
        $findings += "Version $version detected but build number unavailable. Manual verification needed."
    }
}

# Check for IOCs
$libPath = Join-Path $installPath 'server\lib'
$dataPath = Join-Path $installPath 'server\data\content'

# Suspicious .class files in server/lib
if (Test-Path $libPath) {
    $suspiciousClass = Get-ChildItem $libPath -Filter '*.class' -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -notmatch '^(org|com|net|java)' }
    if ($suspiciousClass) {
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += "IOC: Suspicious .class files in server/lib: $($suspiciousClass.Name -join ', ')"
    }
}

# Suspicious .cmd/.out files in data/content
if (Test-Path $dataPath) {
    $suspiciousFiles = Get-ChildItem $dataPath -Include '*.cmd','*.out' -Recurse -ErrorAction SilentlyContinue
    if ($suspiciousFiles) {
        $findings += "IOC: Suspicious files in data/content: $($suspiciousFiles.Name -join ', ')"
    }
}

# Check server.log for exploitation indicators
$logPath = Join-Path $installPath 'server\logs\server.log'
if (Test-Path $logPath) {
    $logContent = Get-Content $logPath -Raw -ErrorAction SilentlyContinue
    if ($logContent -match 'jdbc:derby:memory:pwn|No suitable driver found for jdbc:no:x|Database error looking up cardID: VALUES CAST') {
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += 'IOC: Exploitation indicators found in server.log!'
    }
} else {
    $findings += 'WARNING: server.log missing or inaccessible (possible post-exploitation log deletion).'
}

Write-Host ''
Write-Host '--- Findings ---'
foreach ($f in $findings) { Write-Host "  $f" }
Write-Host ''
Write-Host $status
exit $exitCode

Sources

1. Huntress — PaperCut Zero-Day Active Exploitation Analysis
2. BleepingComputer — PaperCut Releases Second Emergency Patch
3. The Hacker News — Attackers Chain Two PaperCut Flaws
4. PaperCut — Urgent Security Advisory (27 Aug 2026)
5. Help Net Security — PaperCut NG/MF Zero-Day Attacks
6. SC Media — PaperCut Emergency Patches for Critical Vulnerability
7. CWE-470: Unsafe Reflection — MITRE