Back to Fastnexa
Under attack?
CyberBrief
Subscribe
Fastnexa

PaperCut security advisory (AV26-858) – Update 2

Used in attacksCriticalCanadian Centre for Cyber Security · Canadian Centre for Cyber Security·

At a glance

Severity
Critical
Used in attacks
Yes, 2 of 2 flaws named
Flaws named
CVE-2026-82078CVE-2026-81578
Vendors and products
PaperCut
Industries
Government
Reported by
1 outlet

As of August 27, 2026, PaperCut is affected by vulnerabilities in the following products:

  • PaperCut MF
    • Prior to v24 Emergency Patch Release 2
    • Prior to v25 Emergency Patch Release 2
    • Prior to v26 Emergency Patch Release 2
  • PaperCut NG
    • Prior to v24 Emergency Patch Release 2
    • Prior to v25 Emergency Patch Release 2
    • Prior to v26 Emergency Patch Release 2

Update 1

Open-source reporting indicates that CVE-2026-81578 and CVE-2026-82078 are related to PaperCut MF and PaperCut NG are being exploited in the wild.

Update 2

On August 31, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-81578 and CVE-2026-82078 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Originally published by Canadian Centre for Cyber Security. © Canadian Centre for Cyber Security. Written by Canadian Centre for Cyber Security.

Read at cyber.gc.ca ↗Official Source

Vulnerabilities referenced

  • CVE-2026-820789.1Critical

    PaperCut NG/MF

    PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

    Used in attacks

    Added to CISA's list 2026-08-31 · Patch or advisory available

    Full record →
  • CVE-2026-815789.8Critical

    PaperCut NG/MF

    PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

    Used in attacks

    Added to CISA's list 2026-08-31 · Patch or advisory available

    Full record →

Fastnexa security experts

This story involves a flaw attackers are already using. Are you exposed?

A Fastnexa penetration tester can check whether CVE-2026-82078, CVE-2026-81578 or anything like them can be used against your websites, apps and network.

Book a 30-min callWhatsApp us

Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →

Coverage

One outlet has carried this so far.

  1. Canadian Centre for Cyber Security ↗Official SourceFirst reported

    2026-08-31 16:00 UTC

Related stories