CVE-2026-82078

Received Received - Intake

Unsafe Dynamic Class Loading in PaperCut MF and NG

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: PaperCut

Description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82078

EUVD

EUVD-2026-67714

Affected Vendors & Products

Vendor	Product	Version / Range
papercut	papercut_mf	*
papercut	papercut_ng	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

This vulnerability is an unsafe dynamic class loading issue in PaperCut MF and PaperCut NG. The application loads database driver classes using configurable names without checking against an approved list. Attackers who can modify system configuration could execute arbitrary Java bytecode on the application classpath under the PaperCut server process permissions.

Detection Guidance

Check PaperCut server logs for unusual class loading attempts or configuration changes. Review system configuration files for modified driver settings. Use network monitoring tools to detect unexpected outbound connections from the PaperCut server process.

Impact Analysis

An attacker could exploit this to run malicious code on your PaperCut server, potentially leading to unauthorized access, data breaches, or full system compromise. This could expose sensitive print jobs, user data, or network credentials stored on the server.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using PaperCut may face compliance violations if exploited.

Mitigation Strategies

Apply the latest security patch from PaperCut immediately. Restrict write access to PaperCut configuration files. Monitor for unauthorized changes to driver settings. Consider temporarily disabling dynamic class loading if not required.

Hi! I’m here to help you understand CVE-2026-82078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70