CyberWorldOpsCybersicherheit · Threat Intelligence · CVE
Über uns2. September 2026
ITENESFRDE
LIVE

CVE-2026-82078

CRITICAL9.1Veröffentlicht am 28. August 2026

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Aktiv ausgenutzt

  • Seit dem 31. Aug. 2026 im CISA-Katalog ausgenutzter Schwachstellen
  • US-Bundesbehörden müssen sie bis zum 14. Sept. 2026 beheben (BOD 22-01)
  • Angegriffen 1 Tag bevor die Schwachstelle öffentlich wurde

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Quelle: CISA KEV · 31. Aug. 2026 30. Aug. 2026 28. Aug. 2026 28. Aug. 2026 28. Aug. 2026 28. Aug. 2026

CVSS-Score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Schwachstellentyp (CWE)CWE-470
Herstellerpapercut

Betroffene Produkte

HerstellerProdottoVersioni
papercutpapercut mf< 24.1.9
papercutpapercut ng< 24.1.9

Verwandte Artikel

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE-Datenbank