Summary
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
- Vendor
- PaperCut
- Product
- NG/MF
- Added to KEV
- Aug 31, 2026
- Remediation due
- Sep 14, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-470
- EPSS
- 63.0% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References