Vulnerability Report

CVE-2026-82078

CISA KEV Active

Title: CVE-2026-82078

Other

Proof Of Concept

PoC Available for CVE-2026-82078

CWE Category CWE-470

Published Date Aug 28, 2026

Modified Date Sep 01, 2026

Exploit Status Available

Score 9.4 CVSS v4.0

Exploit Probability (EPSS)

1.69%

Vulnerability Summary

CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Impacted Vendors

papercut 2

Reference Links

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

CVSS v4.0

Source Entity eb41dac7-0af8-4f84-9f6d-0272772514f4

Severity CRITICAL

9.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-82078 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/yora1928/PaperCut-CVE-2026-81578-82078

View Code

GitHub https://github.com/virologi-info/papercut-toolkit

View Code

September 01, 2026 MODIFIED