Active Exploitation of PaperCut Vulnerabilities CVE-2026-81578 and CVE-2026-82078

• •CVE-2026-81578 allows unauthorized admin actions via an access control bypass.
• •CVE-2026-82078 enables arbitrary code execution through unsafe dynamic class loading.
• •Both vulnerabilities are actively exploited, with CISA listing them on August 31, 2026.

Two critical vulnerabilities in PaperCut MF/NG have been identified, CVE-2026-81578 and CVE-2026-82078, both published on August 28, 2026. CVE-2026-81578 allows unauthenticated attackers to exploit an access control bypass via crafted POST requests, enabling administrative actions. CVE-2026-82078 involves unsafe dynamic class loading, which can lead to arbitrary Java bytecode execution on the server. Both vulnerabilities were added to the CISA KEV list on August 31, 2026, indicating active exploitation in the wild. Attackers are targeting the Tapestry web interface of PaperCut systems, affecting organizations relying on these applications. The current status of these vulnerabilities is critical, with ongoing exploitation reported. Security professionals are urged to take immediate action to mitigate risks.