[HIGH PRIORITY] PaperCut NG/MF Pre-Auth RCE (CVE-2026-82078)

⚠ HIGH PRIORITY — CISA KEV (Aug 31, 2026). Actively exploited zero-day. CVE-2026-82078 is an unsafe dynamic class-loading flaw (CWE-470) in PaperCut NG/MF database connection utilities. Attackers manipulate driver configuration to execute arbitrary Java bytecode as the PaperCut Application Server process — chained with CVE-2026-81578 for pre-authentication remote code execution.

Affected PaperCut

• All PaperCut NG and MF Application Server versions treated as potentially affected
• Versions 24.x, 25.x, 26.x — emergency patches available
• Internet-exposed print management servers on port 9191/9192
• Public Metasploit module and PoC bypass first emergency patch

Check version

# PaperCut admin UI → About → Version
# Linux server
grep -i version /opt/papercut/server/version.txt 2>/dev/null
ss -tlnp | grep -E '9191|9192'

Patching Method

1. Install Emergency Patch Release 2 immediately — even if Release 1 was applied.
2. Fixed builds: 24.1.10, 25.0.13, 26.0.5.
3. Download from PaperCut security bulletin: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
4. Stop Application Server → apply patch → restart → verify version in admin UI.
5. If on v23 or earlier: upgrade to v24+ with Release 2 — no patch for legacy branches.
6. Card/ID lookup customers: apply required security.properties change per vendor guidance.
7. Forensic hunt: review PaperCut logs, web shell indicators, unauthorized admin accounts.
8. Rotate all PaperCut admin, LDAP/AD sync, and database credentials after patching.

# Restrict exposure until patched
iptables -A INPUT -p tcp --dport 9191 -s TRUSTED_SUBNET -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP

Until patched

• Remove public internet exposure of PaperCut admin/API immediately
• Allowlist management UI to VPN or jump-host IPs only
• Assume compromise if unpatched since Aug 27, 2026 — initiate incident response

CVSS 4.0: 9.4 Critical. Federal deadline: 14 Sep 2026. PoC in Metasploit.