CVE-2026-82078Active Exploitation(papercut / papercut_mf)

CRITICALCVSS 9.1 · CRITICALCISA KEV

Exploitation observed; activity peaked at 28 mentions and remains active

Immediate actions

Patch papercut papercut_mf systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

papercut CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-14. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

Weakness type (CWE)

CWE-470

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

papercut_mf
papercut_ng

Threat summary

Active exploitation appears in 146 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
187 mentions across 31 observed days

What's happening

Active exploitation reported across 146 signals
Exploit tool or code specified in 22 signals
PoC mentioned or linked in 25 signals
Patch or workaround mentioned in 93 signals
Technical details provided in 123 signals
General: 7 classified signals
Peaked 27d ago at 28 mentions (2026-08-31); latest day: 1
187 total mentions across 31 days

Affected systems

Vendors

papercut

Products

papercut_mfpapercut_ng

Deep dive

Activity timeline187 mentions / 31d

Signal classification6 categories

Active Exploitation

13678.2%

Patch

169.2%

General

74.0%

PoC

74.0%

Disclosure

52.9%

Exploit

31.7%

Referenced assets245 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-28	11	Active Exploitation5General3Patch3
2026-08-29	22	Active Exploitation15General2Patch3PoC2
2026-08-30	8	Active Exploitation7Patch1
2026-08-31	28	Active Exploitation20Disclosure1Exploit2General1Patch2PoC2
2026-09-01	26	Active Exploitation19Disclosure1Patch3PoC3
2026-09-02	10	Active Exploitation9Patch1
2026-09-03	6	Active Exploitation6
2026-09-04	4	Active Exploitation3Patch1
2026-09-05	7	Active Exploitation7
2026-09-06	1	Active Exploitation1
2026-09-07	6	Active Exploitation5Disclosure1
2026-09-08	2	Exploit1Patch1
2026-09-09	8	Active Exploitation8
2026-09-10	5	Active Exploitation4Patch1
2026-09-11	5	Active Exploitation5
2026-09-12	3	Active Exploitation2Disclosure1
2026-09-14	7	Active Exploitation6Disclosure1
2026-09-15	1	Active Exploitation1
2026-09-16	1	Active Exploitation1
2026-09-18	1	Active Exploitation1
2026-09-19	2	Active Exploitation2
2026-09-20	1	Active Exploitation1
2026-09-22	1	Active Exploitation1
2026-09-30	9	Active Exploitation7General1

Full discourse20 posts

Stephen Fewer@stephenfewer44d
Exploit
We have published our @metasploit exploit for the recent PaperCut MF and NG zero-day (CVE-2026-81578 + CVE-2026-82078) that is being actively exploited in-the-wild. Module supports both MF and NG editions, and all supported product versions 26.x, 25.x, 24.x. Bypasses vendor emergency patch v1. Emergency patch v2 successfully remediates the chain. Module also has platform agnostic Java payload support (and that will be in-memory on 26.x targets), along with OS command based payloads. https://github.com/rapid7/metasploit-framework/pull/21842
Post summary
The post announces a public Metasploit module for CVE‑2026‑81578 and CVE‑2026‑82078, notes that the exploits are actively used in the wild, references the bypass of a vendor patch, and links to the exploit code.
34601796011.8K
10.0K followersView on X
John Hammond@_JohnHammond46d
Active Exploitation
Been burning the midnight oil a lot this week to chase things -- latest escapade has been digging into PaperCut CVE-2026-81578 and CVE-2026-82078, pre-auth RCE. I recreated a PoC, coordinated with PaperCut, and we saw in-the-wild exploitation. More soon. https://www.huntress.com/blog/papercut-actively-exploited
Post summary
PaperCut pre‑authentication RCE vulnerabilities (CVE‑2026‑81578 and CVE‑2026‑82078) have been actively exploited in the wild, with a PoC recreated by the author and discussed in a Huntress blog post.
82121303717.7K
327.3K followersView on X
watchTowr@watchtowrcyber4d
We're back - doing our best to explain the PaperCut saga, the litany of patch bypasses, and more. Enjoy, and happy Friday! https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
227094306.7K
14.2K followersView on X
Andrew Thompson@ImposeCost34d
Active Exploitation
AGENTS GONE WILD! This adversary used AI to download the advisory, download the pre and post patch versions of the software, built a lab to test the attack, and then went live against hundreds of identified victims vulnerable to CVE-2026-81578 and CVE-2026-82078.
Post summary
Adversaries used AI‑driven scripts to download advisories and test attacks in a lab before launching widespread exploitations of CVE-2026-81578 and CVE-2026-82078 against hundreds of identified victims.
610074317.1K
41.9K followersView on X
blackorbird@blackorbird14d
Active Exploitation
Attackers exploited zero-day PaperCut MF flaws (CVE-2026-82078 / CVE-2026-81578) on an internet-facing print server to inject Java bytecode via SQL injection, load an in-memory Java servlet-filter loader, and deploy a Jetty web shell commanded through the X-Quad header. The webshell then fetched and ran a trojanized Microsoft Copilot PE (mscopilot.exe) that embeds an obfuscated AdaptixC2 implant
Post summary
The text reports active exploitation of zero-day PaperCut MF CVEs (CVE-2026-82078 / CVE-2026-81578) in the wild, detailing an attack chain involving SQL injection, Java bytecode injection, and a Jetty web shell with an AdaptixC2 implant. It confirms real-world exploitation without mentioning patches or PoC codes.
210158345.1K
44.1K followersView on X
Defused@DefusedCyber45d
Active Exploitation
🚨 We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th) An actor is abusing the auth bypass to hijack PaperCut's external user-lookup. Unlike the RCE path in public writeups, the actor goes for data theft - dumping DB tables via Derby ⚠️We haven't yet verified whether the exfil route is a working one Track emerging Papercut MF exploit activity 👉 http://console.defusedcyber.com/signup
Post summary
Active exploitation of CVE-2026-81578/82078 in PaperCut NG/MF is observed, with attackers using an auth bypass to steal database tables; no patches or PoC details are shared.
212165197.9K
7.9K followersView on X
Jake@inkmoro34d
Active Exploitation
👀 @watchtowrcyber Intel captured real, hands-on-keyboard exploitation of the recent PaperCut NG/MF vulnerabilities, including fully decrypting webshell and C2 comms. Check it out: https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway
Post summary
Intel has documented real, ongoing exploitation of PaperCut NG/MF zero‑day CVEs, showing that attackers are actively leveraging these vulnerabilities in the wild.
019043165.0K
278 followersView on X
Giuseppe `N3mes1s`@N3mes1s43d
PoC
As promised the repro of the PaperCut CVE-2026-81578 + CVE-2026-82078: From False Marker to Verified RCE plus update with the variant discovered! https://www.pruva.dev/reproductions/REPRO-2026-00340
Post summary
The post announces a reproducible proof‑of‑concept for PaperCut CVE-2026-81578 and CVE-2026-82078, confirming them as remote‑code‑execution vulnerabilities and overturning earlier false positive reports.
118043164.5K
13.5K followersView on X
CISA Cyber@CISACyber43d
Active Exploitation
🛡️ We added 2 PaperCut NG/MF vulnerabilities to our KEV Catalog: CVE-2026-81578, a missing authentication for critical function vulnerability, and CVE-2026-82078, an unsafe reflection vulnerability. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org. https://t.co/w5JDfzw9SJ
Post summary
PaperCut NG/MF vulnerabilities CVE‑2026‑81578 and CVE‑2026‑82078 have been added to the DHS KEV catalog, indicating they are actively exploited; users are urged to apply mitigations.
21815139.7K
302.4K followersView on X
watchTowr@watchtowrcyber46d
Active Exploitation
🚨The watchTowr team is currently working with PaperCut directly to resolve bypasses in patches released for the actively exploited zero-day vulnerabilities (now CVE-2026-81578, CVE-2026-82078) in PaperCut NG/MF. This situation is evolving, and patches are being released iteratively. If you use PaperCut NG/MF, treat this as a trigger for incident response, and continue to monitor for updates.
Post summary
The text reports that CVE-2026-81578 and CVE-2026-82078 are actively exploited zero‑day vulnerabilities in PaperCut NG/MF, with ongoing patch releases from PaperCut and a recommendation for incident response.
21013995.2K
14.1K followersView on X
YungBinary@YungBinary8d
We’ve published a new blog on an intrusion from last month involving #PaperCut vulnerabilities CVE-2026-82078 and CVE-2026-81578. https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578 Threat actors dropped a Java-based web shell and used it to download/execute an #AdaptixC2 implant which they then used to move laterally to a domain controller. Analyzing the PE files in this intrusion revealed threat actors patched a legitimate Microsoft Copilot binary to call a flattened AdaptixC2 main routine.
111132101.9K
2.1K followersView on X
YBE@Lumideezy38d
Active Exploitation
Attackers are actively exploiting PaperCut flaws (CVE-2026-81578 & CVE-2026-82078) for credential theft targeting schools and universities. Prioritize immediate patching and monitor for unauthorized accounts. #CyberSecurity #CyberAwareness
Post summary
Attackers are actively exploiting CVE‑2026‑81578 and CVE‑2026‑82078 for credential theft against schools and universities, and the message urges immediate patching to mitigate the threat.
8170263268
4.8K followersView on X
Virus Bulletin@virusbtn13d
eSentire's TRU team shows how a threat actor exploited an internet-facing PaperCut MF server to deploy a Java loader & a web shell. Threat actors subsequently used the web shell to deploy a trojanized Microsoft Copilot binary carrying an AdaptixC2 implant. https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578?utm_content=buffer77fc6&utm_medium=social&utm_source=twitter&utm_campaign=Buffer https://t.co/0jCIzgUuoy
08030102.4K
61.6K followersView on X
Aliz (they/them pls)@AlizTheHax0r33d
Active Exploitation
We threat intel now! https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/
Post summary
The message indicates that active exploitation of Papercut NG MF zero‑day CVEs (CVE-2026-81578 and CVE-2026-82078) is reportedly underway.
110276994
1.5K followersView on X
Nicolas Krassas@Dinosn4d
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
00115165.2K
162.5K followersView on X
The Shadowserver Foundation@Shadowserver31d
Active Exploitation
We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @GreyNoiseIO. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'. Dashboard Tree Map stats: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=other_value&day=2026-09-11&source=compromised_iot&source=compromised_website&source=compromised_website6&tag=papercut-compromise&data_set=count&scale=log&auto_update=on https://t.co/ANxXPBB11P
Post summary
Over 400 PaperCut NG/MF instances were compromised via CVE‑2026‑81578/CVE‑2026‑82078, indicating active exploitation, yet no PoC, exploit code, patch, or technical details are provided.
11001342.5K
22.0K followersView on X
Rapid7@rapid746d
Active Exploitation
🚨 On 8/27/26, #PaperCut Software published an urgent security advisory, detailing active exploitation of a vuln affecting PaperCut NG & MF. PaperCut has confirmed customer incidents. More on CVE-2026-81578 and CVE-2026-82078 in our blog: https://r-7.co/46ysbxz https://t.co/M4TDzLgILO
Post summary
PaperCut confirmed ongoing exploitation of CVE-2026-81578 and CVE-2026-82078 with customer incidents, but no PoC, patches, or detailed technical info were provided.
1411666.3K
126.0K followersView on X
Florian Hansemann@CyberWarship6d
''CVE-2026-81578: PaperCut NG/MF CVE-2026-81578 + CVE-2026-82078 unauthenticated RCE chain'' #infosec #pentest #redteam #blueteam https://www.pruva.dev/reproductions/REPRO-2026-00340
11013123.1K
89.6K followersView on X
Dark Web Intelligence@DailyDarkWeb34d
Active Exploitation
🚨 AI-ORCHESTRATED PAPERCUT CAMPAIGN — 440 INSTANCES COMPROMISED GreyNoise says a likely Russian-speaking actor used AI-assisted workflows to develop, test, and operationalize exploits against PaperCut NG/MF on August 31, 2026. The campaign targeted CVE-2026-81578 and CVE-2026-82078 and moved from exploit development to global compromise at remarkable speed. Key numbers: * 440 PaperCut NG/MF instances compromised * 395 identified victim organizations * 48 countries impacted * 280 victims had credential harvesting activity * 147 had OS or domain secrets accessed * 12 organizations reached Domain Admin compromise * 204 victims were in the education sector Speed was one of the most notable elements: * Empty workspace → first real-world RCE in under 4 hours * First Domain Admin compromise roughly 2 hours later * At least 11 organizations compromised in 26 seconds once the campaign launched * Fastest observed path to Domain Admin: 5 minutes * One U.S. high school went from initial access to Domain Admin in 7 minutes The actor reportedly used hundreds of AI agents, OpenAI Codex as a harness, a DeepSeek model, and publicly available offensive security tooling to orchestrate reconnaissance, exploitation, credential theft, and lateral movement in parallel. Where Domain Admin was achieved, GreyNoise observed three main paths: * Harvesting LSASS and registry secrets from domain-joined PaperCut hosts, followed by pass-the-hash * Exploiting unpatched CVE-2021-42278 / CVE-2021-42287 via noPac * Abusing PaperCut systems already running on domain controllers or under Domain Admin service accounts All successful Domain Admin paths ultimately led to DCSync activity and NTDS.DIT credential extraction. Analyst Note: The important development here is not a new exploitation primitive. It is orchestration. AI allowed the actor to compress reconnaissance, exploit development, credential harvesting, and post-exploitation activity into massively parallel workflows operating at machine speed. But the campaign also reinforces something equally important: traditional defensive controls still matter. GreyNoise observed at least one exploitation attempt blocked by Cloudflare WAF, and basic measures such as patching, segmentation, reduced internet exposure, and Active Directory hardening remain effective. Same vulnerabilities. Much faster adversary. #DDW #CyberSecurity #ThreatIntelligence #AI #PaperCut #AgenticAI #Vulnerability #ActiveDirectory #OSINT
Post summary
GreyNoise reports a large, AI‑driven campaign that leveraged CVE‑2026‑81578 and CVE‑2026‑82078 to compromise 440 PaperCut instances worldwide, achieving rapid RCEs and domain admin takeovers, while emphasizing that foundational defenses such as patching and segmentation remain effective.
1101286.6K
208.5K followersView on X
mRr3b00t@UK_Daniel_Card34d
Active Exploitation
Great blog post by @GreyNoiseIO !! this shows a TA exploiting PaperCut: CVE-2026-81578 and CVE-2026-82078 and then pivot and exploit networks further! you can see here armed with an LLM they did not just magically hack all the things! https://t.co/cr3O0oiXMA
Post summary
The tweet reports that a threat actor is actively exploiting PaperCut CVE-2026-81578 and CVE-2026-82078, pointing to a blog post that demonstrates these attacks.
0111064.5K
126.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	papercut	papercut_mf	-	-	-
App	papercut	papercut_ng	-	-	-

Explore more

Back to dashboard papercut CVEs papercut_mf vulnerabilities

What researchers are saying

CVE-2026-82078

Stephen Fewer[verified]@stephenfewerExploit

The post announces a public Metasploit module for CVE‑2026‑81578 and CVE‑2026‑82078, notes that the exploits are actively used in the wild, references the bypass of a vendor patch, and links to the exploit code.

John Hammond[verified]@_JohnHammondActive Exploitation

PaperCut pre‑authentication RCE vulnerabilities (CVE‑2026‑81578 and CVE‑2026‑82078) have been actively exploited in the wild, with a PoC recreated by the author and discussed in a Huntress blog post.

Andrew Thompson[verified]@ImposeCostActive Exploitation

Adversaries used AI‑driven scripts to download advisories and test attacks in a lab before launching widespread exploitations of CVE-2026-81578 and CVE-2026-82078 against hundreds of identified victims.

blackorbird[verified]@blackorbirdActive Exploitation

The text reports active exploitation of zero-day PaperCut MF CVEs (CVE-2026-82078 / CVE-2026-81578) in the wild, detailing an attack chain involving SQL injection, Java bytecode injection, and a Jetty web shell with an AdaptixC2 implant. It confirms real-world exploitation without mentioning patches or PoC codes.

Jake[verified]@inkmoroActive Exploitation

Intel has documented real, ongoing exploitation of PaperCut NG/MF zero‑day CVEs, showing that attackers are actively leveraging these vulnerabilities in the wild.

Giuseppe `N3mes1s`[verified]@N3mes1sPoC

The post announces a reproducible proof‑of‑concept for PaperCut CVE-2026-81578 and CVE-2026-82078, confirming them as remote‑code‑execution vulnerabilities and overturning earlier false positive reports.

watchTowr[verified]@watchtowrcyberActive Exploitation

The text reports that CVE-2026-81578 and CVE-2026-82078 are actively exploited zero‑day vulnerabilities in PaperCut NG/MF, with ongoing patch releases from PaperCut and a recommendation for incident response.

YBE[verified]@LumideezyActive Exploitation

Attackers are actively exploiting CVE‑2026‑81578 and CVE‑2026‑82078 for credential theft against schools and universities, and the message urges immediate patching to mitigate the threat.