Back viz.greynoise.io

CVE-2026-82078

viz.greynoise.io • September 29, 2026

IP addresses with this tag have been observed attempting to exploit an unsafe dynamic class loading vulnerability in PaperCut NG/MF, sending crafted database driver configuration requests that can lead to arbitrary Java bytecode execution on the server.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of PaperCut Vulnerabilities CVE-2026-81578 and CVE-2026-82078 Two critical vulnerabilities in PaperCut MF/NG have been identified, CVE-2026-81578 and CVE-2026-82078, both published on August 28, 2026. CVE-2026-81578 allows unauthenticated attackers to exploit an access control bypass via crafted POST requests, enabling administrative actions. CVE-2026-82078 involves unsafe dynamic class loading, which can lead to arbitrary Java bytecode execution on the server. Both vulnerabilities were added to the CISA KEV list on August 31, 2026, indicating active exploitation in the wild. Attackers are targeting the Tapestry web interface of PaperCut systems, affecting organizations relying on these applications. The current status of these vulnerabilities is critical, with ongoing exploitation reported. Security professionals are urged to take immediate action to mitigate risks. 73

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-82078