External risk intelligence

PaperCut MF/NG Unsafe Dynamic Class Loading Vulnerability

CVE advisoryKnown Exploit

CVE-2026-82078

PaperCut MF/NG typically resides in internal networks. While services can be exposed to the internet for remote access, they are not inherently designed as public-facing gateways. Internet reachability is a deployment-specific configuration rather than a default state.

Papercut Mf

before 24.1.925.0.2 to before 25.0.1226.0.2 to before 26.0.4

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts PaperCut MF and NG database connection utilities, allowing attackers to potentially execute arbitrary code on the server if they can alter system configurations. The main concern is to confirm if this specific software is deployed and accessible.

Unsafe code loading in database drivers.
Attackers can run code on servers.
Confirm if your PaperCut software is affected.

Attack Path

How an attacker could exploit the issue

An attacker with privileged access to system configuration can introduce malicious Java bytecode into the application's classpath. This can lead to arbitrary code execution on the server when the database connection utility loads an unsafe, dynamically instantiated driver.

Attacker needs privileged configuration access.
Dynamically loads unvalidated database drivers.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When an attacker can manipulate system configuration parameters, arbitrary Java bytecode could be executed on the PaperCut server. This could occur when the application instantiates database driver classes based on unvalidated, configurable driver names.

Server-side code execution.
Configuration manipulation by an attacker.
Compromise of the PaperCut server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts PaperCut MF and NG, likely managed by platform or infrastructure teams responsible for the application's server environment. The first practical step is to identify all PaperCut deployments, confirm their network exposure and business criticality, and then locate the accountable system owner to prioritize and plan remediation.

Identify system owners and confirm exposure.
Verify business criticality and assess risk.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PaperCut MF and PaperCut NG?

PaperCut MF and NG are print management software solutions designed to monitor, control, and secure printing, copying, and scanning tasks within an organization. They act as a central hub for managing document workflows across a network of printers and multifunction devices.

What does CVE-2026-82078 mean by unsafe dynamic class loading?

This vulnerability, classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), happens because the software attempts to load database driver code based on configuration settings without verifying if the requested driver is legitimate. This allows a malicious actor to point the software toward unauthorized code instead of a valid database driver.

How does an attacker trigger this vulnerability?

An attacker must gain privileged access to the server's configuration parameters to specify a malicious database driver. Simply sending network requests to the application without prior, unauthorized control over these internal configuration settings will not trigger the vulnerability.

Is my PaperCut server at risk?

Halo Surface Signal notes that PaperCut MF and NG are typically used within internal networks rather than as public-facing gateways. While they may be reachable if specifically configured for remote access, the primary risk involves the network location and the security of the administrative access paths to the server configuration.

What should I do if I run PaperCut software?

Start by identifying all deployments of PaperCut MF or NG within your environment. Once identified, confirm the network exposure of these instances and verify who owns or manages the server infrastructure to ensure they are aware of the need to prioritize and plan remediation in coordination with vendor guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.