CVE-2026-82078Vulnerability

PaperCut NG/MF Unsafe Reflection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 31 Aug 2026.

Reported by 7 independent sources · first reported 28 Aug 2026 by Huntress · last reported 13 Oct 2026

Last reported 12 days ago

CISA KEVAdded 31 Aug 2026
Fix due 14 Sep 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS63.5%
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

9 reports, newest first · the exact sentence from each

“CVE-2026-82078”

Recorded FutureVendor13 Oct 2026
September 2026 CVE Landscape
“Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)”

watchTowr LabsVendor9 Oct 2026
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
“Attackers Exploit PaperCut Flaws to Deliver AdaptixC2 — In late August 2026, threat actors exploited CVE-2026-82078 and CVE-2026-81578, two PaperCut MF vulnerabilities, as zero-days to load an in-memory Java loader, which in turn deployed a web shell.”

The Hacker NewsNews5 Oct 2026
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
“PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)”

Rapid7Vendor11 Sep 2026
Metasploit Wrap Up: This One Goes to Sixteen!
“…(MCA) used 45.142.193.132 and artificial intelligence (AI) to develop, test, and use exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078).”

GreyNoiseVendor9 Sep 2026
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
“CVE-2026-82078”

Recorded FutureVendor8 Sep 2026
August 2026 CVE Landscape
“CVE-2026-81578, rated CVSS 8.8, enables authentication bypass, while CVE-2026-82078, rated CVSS 9.4, involves unsafe class loading.”

Check Point ResearchVendor31 Aug 2026
31st August – Threat Intelligence Report
“However on August 28, the vendor assigned CVE-2026-81578 and CVE-2026-82078 for the two vulnerabilities that make up the exploit chain.”

Rapid7Vendor28 Aug 2026
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
“CVE-2026-82078 is an unsafe dynamic class-loading vulnerability in the database connection utilities that can be used to execute arbitrary Java bytecode.”

HuntressVendor28 Aug 2026
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

Indicators reported together

named in the same reports

Also named with it: CVE-2026-81578, CVE-2026-60004, CVE-2022-0847, CVE-2026-39987, CVE-2026-63030, CVE-2021-29441, CVE-2026-81963, CVE-2026-63077, CVE-2026-20079, CVE-2026-83548, CVE-2026-83549, CVE-2026-75604, CVE-2023-27350, CVE-2026-76504, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300

Thanks — we review every report.

Report a wrong value