HIGHVulnerability
Verified
Global

CISA KEV: PaperCut NG/MF — PaperCut NG/MF Unsafe Reflection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

Analysis

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-28. Remediation due: 2026-09-11.

Indicators of Compromise (2)

CVE (2)
CVE-2026-81578
NVDMITRE CVE
CVE-2026-82078
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 28, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

Cyberattack shuts down refrigerators at French supermarkets

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108896 — A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the functio...

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108896
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108895 — A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected elemen...

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not

CVE-2026-108895
NIST NVD