Unsafe reflection in PaperCut - rewriting settings to execute Java code (CVE-2026-82078)
An unsafe reflection vulnerability in the print management software PaperCut NG/MF has been added to CISA's Known Exploited Vulnerabilities catalog. Manipulating configuration parameters executes Java bytecode residing on the classpath.
Key facts
- CVE IDCVE-2026-82078
- Affected (vendor / product)PaperCut NG/MF
- CWECWE-470
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-09-14 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Unsafe reflection (CWE-470) allows manipulation of configuration parameters to execute Java bytecode on the classpath.
- Execution occurs in the security context of the PaperCut server process.
- The attacker need not deliver new code: code already on the server is called in an unanticipated combination.
- CISA's description states explicitly that it can be chained with CVE-2026-81578.
- Of the 1,687 KEV records this site holds as of 2026-09-02, only two include CWE-470.
- It was added on 31 August 2026, the same day as its chaining partner, with the same due date of 14 September 2026.
1What reflection is
Reflection lets a program decide at runtime which class and method to call, often from a string. It enables flexible design, and where the target of the call can be supplied from outside it becomes a doorway for running unintended code. Unsafe reflection (CWE-470) names that condition.
What matters is that the attacker need not deliver new code. It suffices to have code already present on the server's classpath called in an unanticipated combination.
2An uncommon kind of weakness
CWE-470 appears in only two of the 1,687 records this site holds as of 2026-09-02. Rarity does not mean lower danger. It may instead indicate a field where patterns of defence are not established and detection is not built out.
3Two entries for one product added the same day
This vulnerability and its chaining partner CVE-2026-81578 were both added to KEV on 31 August 2026 with the same due date of 14 September 2026. Closing one leaves an end of the chain intact. Where two entries for one product appear on the same day, treating them as a pair is the safer judgement. Five records this site holds as of 2026-09-02 concern PaperCut.
Why it matters
Attacks that call code already on the classpath are hard to catch with mechanisms built to detect files delivered from outside. That only two KEV entries carry this weakness suggests a field where defensive patterns and detection knowledge have not accumulated. Where two chained entries for one product are added together, planning has to treat them as a pair rather than one at a time.
FAQ
What is unsafe reflection?
Does the attacker upload code?
Does the chaining partner also need attention?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).