Critical Pre‑Auth RCE & Unsafe Reflection Flaws (CVE‑2026‑81578, CVE‑2026‑82078) in PaperCut NG/MF Added to CISA KEV Catalog
What It Is – PaperCut NG/MF, the print‑management platform used in schools, hospitals and offices, contains two high‑severity flaws: a missing‑authentication pre‑auth remote‑code‑execution (CVE‑2026‑81578, CVSS 8.8) and an unsafe‑reflection vulnerability that lets an attacker load arbitrary Java classes (CVE‑2026‑82078, CVSS 9.4).
Exploitability – Both vulnerabilities are listed in the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. Huntress has observed active exploitation in two customer environments and reproduced the full attack chain against an unpatched server.
Affected Products – PaperCut NG/MF versions prior to 25.0.11.75758 (the vulnerable baseline).
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The pre‑auth flaw bypasses authentication, directly testing the control objective of “enforcing proper authentication and authorization for privileged functions.”
- Continuous monitoring – Exploitation leaves a brief, observable footprint (system discovery commands). Capturing such logs provides defensible evidence that the control is being monitored.
- Audit readiness – Demonstrating that you have patched, and that you retain immutable logs of configuration changes, satisfies auditors who look for evidence of “secure configuration management” across frameworks (e.g., NIST CSF 2.0).
Recommended Actions
- Patch immediately – Apply PaperCut’s security update that resolves CVE‑2026‑81578 and CVE‑2026‑82078.
- Validate authentication enforcement – Conduct a focused test to confirm that all critical functions require proper authentication.
- Enable and retain detailed server‑side logs (request handling, configuration changes, command execution) for at least 90 days.
- Update incident‑response playbooks to include detection of the specific request patterns used in the exploit chain.
- Perform a rapid control‑mapping review against your framework of record to confirm the “access‑control” objective is satisfied.
Source: Security Affairs article