CVE-2026-82078
KEV EPSS 1.7%KEV confirmed exploited, public PoC/Metasploit available, vendor emergency patch, defenders actively responding, chained vulnerability enabling critical impact.
What: Unsafe dynamic class loading in PaperCut MF/NG database utilities allowing arbitrary Java bytecode execution under server context when configuration is manipulated (EPSS 0.38%).
Why it matters: KEV-listed as actively exploited in-the-wild since 2026-08-31. Chained with CVE-2026-81578 (auth bypass) to achieve unauthenticated RCE. Metasploit PoC published; Rapid7 and vendor (PaperCut Emergency Patch Release 2) confirm active abuse. Defenders triaging now.
Where it's seen: Security researchers posting exploitation chains, Metasploit module submission, vendor emergency patch released, CISA KEV alert, detection runbooks published (CrowdStrike CQL rules), threat intelligence feeds.
RISK: CRITICAL — KEV-listed, active in-the-wild exploitation, unauthenticated RCE via auth-bypass chain, mass patching underway.
Description
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.