CISA ADDS TWO ACTIVELY EXPLOITED PAPERCUT NG/MF VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Active Exploitation / Known Exploited Vulnerabilities / Authentication Bypass / Unsafe Reflection / Print Management Infrastructure
Affected Product(s): PaperCut NG / PaperCut MF
CVE(s): CVE-2026-81578, CVE-2026-82078
Primary Risks: Authentication Bypass, Unauthorized Access to Security-Sensitive Functions, Unsafe Application Behavior, Potential Compromise of Affected PaperCut Systems
Threat Status: Confirmed Active Exploitation
Affected Environment(s): PaperCut NG/MF Deployments, Federal Civilian Executive Branch Environments, Publicly Exposed and Internal PaperCut Systems Where Affected Versions Are Present
Attack Vector(s): Exploitation of Missing Authentication for a Critical Function and Unsafe Reflection Vulnerabilities — Exact Exploit Chain and Threat Actor Techniques Not Disclosed by CISA
CISA Action: Added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities Catalog on August 31, 2026
Required Response: Identify Affected PaperCut NG/MF Deployments, Review Official Vendor Guidance, Apply Required Remediation, Prioritize High-Risk Publicly Exposed Assets and Assess for Prior Compromise Where BOD 26-04 Criteria Apply

---

The Cybersecurity and Infrastructure Security Agency added two vulnerabilities affecting PaperCut NG and PaperCut MF to its Known Exploited Vulnerabilities Catalog on August 31, 2026, after determining that both are being exploited under real-world conditions.

The additions are:

• CVE-2026-81578 — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
• CVE-2026-82078 — PaperCut NG/MF Unsafe Reflection Vulnerability

CISA did not identify the threat actors exploiting the vulnerabilities, targeted organizations, victim count, affected sectors or geographic scope.

The August 31 alert also did not disclose the specific exploitation procedures, indicators of compromise, initial access requirements, post-exploitation activity or whether the two vulnerabilities are being chained together in active attacks.

Organizations operating PaperCut NG or PaperCut MF should review the complete KEV entries and official PaperCut security guidance to determine whether their deployments are affected.

What makes this development significant is not simply that two new flaws entered the KEV Catalog, but that both affect a platform that can sit deep inside an organization’s daily operations. Print-management infrastructure is often treated as routine background technology, yet once a system becomes part of authentication, administration, and internal service workflows, a weakness in that environment can carry consequences far beyond the printer queue. CISA has not disclosed the full exploitation path, but the decision to place both PaperCut vulnerabilities in the KEV Catalog means defenders should treat the issue as an active security problem rather than a theoretical software defect.

---

Vulnerability Details

CVE-2026-81578 — Missing Authentication for Critical Function

CVE-2026-81578 is classified as a missing authentication for critical function vulnerability affecting PaperCut NG and PaperCut MF.

CISA did not disclose the specific exploitation method, access requirements, or technical impact beyond confirming active exploitation.

The KEV listing confirms active exploitation. It does not establish that every PaperCut deployment is equally exposed.

---

CVE-2026-82078 — Unsafe Reflection

CVE-2026-82078 is classified as an unsafe reflection vulnerability affecting PaperCut NG and PaperCut MF.

CISA did not disclose whether exploitation of CVE-2026-82078 results directly in code execution, privilege escalation or another post-authentication capability.

Organizations should avoid assuming a complete compromise path until official technical guidance establishes the exact behavior.

---

Operational Impact

• Emergency identification of PaperCut NG and PaperCut MF deployments
• Prioritization of publicly exposed PaperCut servers
• Review of administrative portals and management interfaces
• Accelerated application of vendor security updates or mitigations
• Restriction of unnecessary Internet-facing access
• Examination of authentication and application logs
• Review of unexpected configuration changes
• Review of service accounts and directory integrations
• Isolation of systems showing evidence of unauthorized activity
• Compromise assessments for systems exposed before remediation

Print-management systems can occupy a trusted position inside enterprise environments.

A compromised server may provide an attacker with access to credentials, administrative workflows, network services or connected systems depending on the organization’s architecture.

Applying the required remediation addresses the known vulnerability. It does not determine whether an attacker accessed the system before correction.

---

Federal Response

Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The directive requires agencies to prioritize remediation of high-risk KEV vulnerabilities affecting publicly exposed assets when exploitation can grant total control of the affected asset.

BOD 26-04 also establishes expectations for determining when agencies must investigate whether compromise occurred before remediation.

The addition of CVE-2026-81578 and CVE-2026-82078 to the KEV Catalog confirms active exploitation.

It does not establish that every PaperCut deployment meets the same exposure, privilege or post-exploitation conditions.

The directive applies directly to Federal Civilian Executive Branch agencies.

CISA continues to encourage state, local, private-sector and other organizations to adopt risk-based vulnerability management and prioritize KEV-listed vulnerabilities.

---

KEV

CISA added:

• CVE-2026-81578 — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
• CVE-2026-82078 — PaperCut NG/MF Unsafe Reflection Vulnerability

A KEV designation means CISA has evidence of active exploitation.

KEV inclusion does not identify the attacker, complete intrusion method, targeted organization or number of successful compromises.

Potential KEV additions must include:

• A valid CVE identifier
• Evidence of active exploitation
• Clear mitigation guidance

The presence of both PaperCut vulnerabilities in the catalog indicates that organizations should treat remediation as an immediate operational priority rather than a routine patching task.

---

Defensive Guidance

• Inventory all PaperCut NG and PaperCut MF installations.
• Identify Internet-facing and externally accessible deployments.
• Review the KEV entries for CVE-2026-81578 and CVE-2026-82078.
• Review official PaperCut security guidance and affected-version information.
• Apply vendor-provided patches or mitigations as soon as possible.
• Restrict unnecessary external access to PaperCut administrative interfaces.
• Limit management access to trusted networks or approved administrators.
• Examine authentication, application and operating-system logs for suspicious activity.
• Review recent configuration changes and newly created accounts.
• Isolate PaperCut servers showing evidence of unauthorized activity.
• Conduct compromise assessments on systems exposed before remediation.
• Rebuild systems that cannot be verified as trustworthy.
• Confirm remediation and continue monitoring after correction.

---

30-Day Outlook

• Continued exploitation attempts against unpatched PaperCut deployments
• Increased scanning for publicly exposed PaperCut NG and PaperCut MF servers
• Accelerated patching across federal and enterprise environments
• Greater scrutiny of administrative access and authentication logs
• Increased review of print-management infrastructure connected to identity systems
• Additional compromise assessments on previously exposed PaperCut servers
• Increased monitoring for follow-on activity after initial exploitation
• Greater attention to service-account and directory permissions
• Continued federal prioritization under BOD 26-04
• Possible release of additional technical indicators or exploitation details as investigations progress

---

TRJ Verdict

CISA’s addition of CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities Catalog confirms that attackers are actively targeting weaknesses in PaperCut NG and PaperCut MF.

The significance of these vulnerabilities extends beyond routine print administration.

CISA has not disclosed whether attackers are chaining the vulnerabilities, what organizations have been compromised or what post-exploitation activity has occurred.

Organizations should avoid speculation and focus on the confirmed risk: identify affected deployments, apply official remediation, prioritize exposed systems and assess for prior compromise where appropriate.

Applying the required remediation addresses the known vulnerability.

A compromise assessment determines whether an attacker was already inside.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---