CVE-2026-82078

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.

Critical Known exploited

Severity: 9.4 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 63.05%; Chance of exploitation in the next 30 days. Higher than 99.20% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Aug 31, 2026
Weakness: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Fix: None yet; No fixed version published

Exploited in the wild. PaperCut NG/MF Unsafe Reflection Vulnerability (PaperCut NG/MF). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 14, 2026.

Description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 9.4

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): High
Integrity (subsequent systems): High
Availability (subsequent systems): High
Exploit maturity: Not defined
Scope: X

CVSS 3.1 9.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

How to prevent it

Architecture and Design: Refactor your code to avoid using reflection.
Architecture and Design: Do not use user-controlled inputs to select and load classes or code.
Implementation: Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.

References

Advisories

Fixes and patches

github.com/rapid7/metasploit-framework/pull/21842

Timeline

Aug 28, 2026 Published
Aug 31, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Sep 14, 2026 Remediation due for U.S. federal agencies
Sep 14, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules	Critical	Same weakness, CWE-470
GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints	Medium	Same weakness, CWE-470
GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction	Medium	Same weakness, CWE-470
DRUPAL-CORE-2026-014 A remote code execution vulnerability exists within the Field UI module in Drupal core.	Not rated yet	Same weakness, CWE-470
GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution	Medium	Same weakness, CWE-470
GHSA-73mf-m39p-wpm9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)	Critical	Same weakness, CWE-470
GHSA-j2vp-f2pv-5rj4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction	Medium	Same weakness, CWE-470
GHSA-7pgq-cr25-xvc8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure	High	Same weakness, CWE-470

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor