CISA Adds Two Actively Exploited PaperCut NG/MF Vulnerabilities (CVE‑2026‑81578, CVE‑2026‑82078) to KEV Catalog
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) announced that two PaperCut NG/MF flaws—CVE‑2026‑81578 (missing authentication for a critical function) and CVE‑2026‑82078 (unsafe reflection)—have been added to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild.
Exploitability — Both CVEs are confirmed to be weaponised by threat actors; CISA’s inclusion in the KEV catalog signals a high‑severity, actively‑exploited state.
Affected Products — PaperCut NG and PaperCut MF (print‑management solutions used by enterprises and public‑sector organizations).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a risk‑based vulnerability management program that can surface high‑impact flaws quickly and provide auditable evidence of remediation.
- Highlights the importance of continuous asset inventory and control mapping so that any publicly‑exposed PaperCut instance is flagged and prioritized under BOD 26‑04.
- Provides a concrete control‑objective test: “Maintain up‑to‑date vulnerability remediation evidence for all critical assets,” which maps to multiple frameworks (e.g., NIST CSF Identify and Protect, ISO 27001 A.12.6).
Recommended Actions
- Verify whether PaperCut NG/MF is deployed on any public‑facing assets.
- Prioritize patching to the latest vendor‑released versions for CVE‑2026‑81578 and CVE‑2026‑82078.
- Capture remediation tickets, patch‑deployment logs, and post‑patch scans as evidence for audit readiness.
- Update your vulnerability‑management dashboard to flag any KEV‑listed CVEs automatically.
Source: CISA Advisory – 31 Aug 2026