Critical Vulnerabilities in PaperCut NG and PaperCut MF Exploited in the Wild
PaperCut Software has disclosed two serious vulnerabilities in its printing management solutions PaperCut NG and PaperCut MF. The issues were detailed in an advisory published on August 27, 2026, followed by emergency patches. Exploitation has already been confirmed in customer environments. CVE-2026-81578 stems from improper access controls in the web management interface, allowing unauthenticated remote changes to system settings. CVE-2026-82078 involves insecure dynamic class loading in database connections, enabling arbitrary Java bytecode execution with server privileges when combined with the first flaw. CVSS scores are 9.4 (Critical) and 8.8 (High) respectively, and both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog.
Security NEXTSep 1, 2026Translated from Japanese