Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-81578 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2026 |
| Publication Date | 2026-08-31 |
| Vendor | PaperCut |
| Product | NG/MF |
| CVSS Score | N/A (Unknown) |
| EPSS Score | 0.4% (percentile: 32%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-09-14 |
Vulnerability Description
PaperCut NG/MF contains a vulnerability of the missing authentication for critical function class - some of the functions that change the system configuration are available without authentication. An unauthenticated attacker with network access to the server can remotely modify selected application settings.
Changing the configuration is only the first step. The vulnerability is chained with CVE-2026-82078 (unsafe reflection), which makes it possible to move from an unauthorized parameter change to executing arbitrary Java bytecode in the context of the PaperCut server process.
CISA has added CVE-2026-81578 to the Known Exploited Vulnerabilities catalog - exploitation is confirmed in real-world attacks, not merely theoretical.
Required Actions
-
Update PaperCut NG/MF to the version indicated in the vendor bulletin. CISA due date: September 14, 2026.
-
Patch CVE-2026-82078 at the same time. Both vulnerabilities form a chain - updating only one of them leaves the path to code execution open.
-
Restrict network access to the server. Ports 9191/9192 should not be reachable from the internet; limit administrative access to a dedicated management network.
-
Verify the integrity of the configuration. Compare the current server settings against a backup from before the vulnerability window - in particular the integration settings, scripts and administrative accounts.
-
Search the logs for requests to configuration endpoints originating from outside trusted addresses.
-
If the server was exposed to the internet - run a full incident response process, assuming possible compromise.
Who Is Affected?
Organizations using PaperCut NG or PaperCut MF. In Poland, this means mainly public administration, universities, hospitals, and medium and large companies with extensive print infrastructure.
Installations whose server is reachable from the internet or from a guest network are critical. It is worth remembering that a PaperCut server usually has a service account in Active Directory and access to the documents held in print queues - taking it over does not end with the printing module.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
