The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two significant vulnerabilities in PaperCut NG/MF that are currently being exploited in real-world attacks. These flaws were officially added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog on August 31, 2026, underscoring their urgency and the immediate risk to organizations using the print management software. The agency has set a remediation deadline of September 14, 2026 for U.S. federal civilian executive branch entities.
What’s at Stake
PaperCut NG and MF are platforms used globally by educational institutions, government agencies, enterprises, and managed service providers to manage print workflows, user authentication, quotas, and server configurations. Because of their central position in many organizations’ infrastructure, any compromise of these systems can serve as an entry point into larger corporate or government networks.
The two vulnerabilities in question—CVE-2026-81578 and CVE-2026-82078—are both severe yet distinct. The first is a missing authentication flaw (classified as CWE-306), allowing unauthenticated remote attackers to alter high-impact server configuration settings without needing valid credentials. The second is an unsafe reflection issue (CWE-470) that enables execution of arbitrary Java bytecode that resides somewhere on the application’s classpath. If exploited, this can grant attackers the same level of access as the PaperCut server process itself.
Chaining the Vulnerabilities & Mitigation Urgency
Most alarming is the potential for chaining these two flaws. An attacker could exploit the missing authentication bug to change settings without credentials, then leverage the unsafe reflection vulnerability to run malicious code. Together, this could lead to pre-authenticated remote code execution—a serious breach risk. Systems exposed to the internet—especially those with management interfaces that are accessible publicly—are particularly vulnerable.
CISA recommends that administrators prioritize patches and available mitigations. Key steps include ensuring that administrative interfaces are not reachable from public networks, minimizing the privileges under which the PaperCut service runs, and reviewing logs for unusual configuration changes or anomalous Java process activity. For environments where remediation or patching isn’t immediately possible, isolating affected systems or discontinuing use is advised.
Although these vulnerabilities are now catalogued in CISA’s KEV list, there is currently no confirmation that either flaw has been leveraged for ransomware attacks. That said, their active exploitation in other attack contexts makes swift action essential. CISA notes that while forensic triage is not mandated under BOD 26-04 for these specific defects, the risk posed by chained exploitation warrants proactive investigation in all potentially affected environments.
What to Watch For: the upcoming September 14 deadline, updates or patches from PaperCut, and reports of incidents tied to these CVEs. Also: whether breach disclosures or threat actor groups begin publicizing their use of these vulnerabilities.
This development underlines how relatively obscure enterprise tools can become prime targets when flaws allow remote configuration changes and code execution. With attackers exploiting these types of vulnerabilities in printing software, organizations need to reassess their security visibility around non-traditional systems—printers, print servers, and workflow tools—and ensure they are not the weak link. Vigilance, speed, and clear remediation paths will make the difference.
