Back viz.greynoise.io

CVE-2026-81578

viz.greynoise.io • September 29, 2026

IP addresses with this tag have been observed sending crafted POST requests to PaperCut MF/NG's Tapestry web interface using a service=direct/.../ / URI pattern that exploits a page-confusion access control bypass, allowing unauthenticated attackers to trigger administrative backend actions and modify system configuration.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of PaperCut Vulnerabilities CVE-2026-81578 and CVE-2026-82078 Two critical vulnerabilities in PaperCut MF/NG have been identified, CVE-2026-81578 and CVE-2026-82078, both published on August 28, 2026. CVE-2026-81578 allows unauthenticated attackers to exploit an access control bypass via crafted POST requests, enabling administrative actions. CVE-2026-82078 involves unsafe dynamic class loading, which can lead to arbitrary Java bytecode execution on the server. Both vulnerabilities were added to the CISA KEV list on August 31, 2026, indicating active exploitation in the wild. Attackers are targeting the Tapestry web interface of PaperCut systems, affecting organizations relying on these applications. The current status of these vulnerabilities is critical, with ongoing exploitation reported. Security professionals are urged to take immediate action to mitigate risks. 73

Extracted Entities

CVE-2026-81578

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)