CISA Adds Actively Exploited PaperCut NG/MF RCE Chain to Known Exploited Vulnerabilities Catalog

On August 31, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities affecting PaperCut NG and PaperCut MF print-management platforms to its Known Exploited Vulnerabilities (KEV) Catalog. The dual flaws encompass CVE-2026-81578, a high-severity (CVSS 8.8) authentication bypass flaw within the web management interface where backend administrative actions execute prior to validation checks, and CVE-2026-82078, a critical (CVSS 9.4) unsafe dynamic class-loading vulnerability in database connection utilities. When chained together, an unauthenticated remote adversary can execute arbitrary Java bytecode under the application server process context. Pursuant to Binding Operational Directive (BOD) 26-04, federal civilian agencies must remediate the flaws by September 14, 2026. This development matters because print management software routinely bridges sensitive corporate subnets, workstation segments, and core enterprise directory environments. Gaining unauthenticated remote code execution on an application server provides attackers with a robust pivot point for credential harvesting, privilege escalation, and rapid lateral movement across hybrid environments. Because PaperCut instances frequently interface with corporate Active Directory and database infrastructure, compromising the server grants adversaries expansive reach across internal assets. The exploit chain reflects a persistent pattern in enterprise security: peripheral enterprise utilities becoming primary vectors for initial access. Over the past several years, edge software, monitoring tooling, and administrative middleware have increasingly been targeted by both cybercriminal syndicates and advanced persistent threat (APT) groups seeking high-privilege access without triggering traditional endpoint detection rules. Chaining an authentication check bypass with server-side class loading or unsafe reflection remains one of the most effective and reliable paths for attackers to achieve complete remote system takeover. In practice, security engineers and system administrators must immediately ensure PaperCut application and secondary site servers are updated to hardened releases (including versions 24.1.10, 25.0.13, and 26.0.5 or vendor-provided emergency patches). Organizations unable to deploy patches immediately should restrict access to web management ports to strictly allowlisted internal management subnets and verify that print servers are isolated from public internet exposure. Security operations teams should simultaneously initiate threat hunting across print server access logs and telemetry for anomalous HTTP requests, unexpected child processes spawned by Java runtime environments, or unauthorized configuration edits.