Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82078

PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

CVSS 4.0 9.4 CRITICALCheck source for fixed versionsCISA KEV

Original advisory

cve-program · CVE-2026-82078

Published

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82078

Published

PaperCut MF/NG

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "PaperCut",
                    "product": "PaperCut MF/NG",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "24.1.10",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "25.0.0",
                            "lessThan": "25.0.13",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "26.0.0",
                            "lessThan": "26.0.5",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON