PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Can be chained with CVE-2026-81578. Added to CISA KEV on 2026-08-31 (federal deadline 2026-09-14).

First seen: 31 Aug 2026
Last update: 31 Aug 2026, 12:00 UTC
Identifiers: CVE-2026-81578
CVE-2026-82078
Source: CISA KEV
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## PaperCut NG/MF Unsafe Reflection Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: PaperCut NG/MF
Ids: CVE-2026-81578, CVE-2026-82078

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Can be chained with CVE-2026-81578. Added to CISA KEV on 2026-08-31 (federal deadline 2026-09-14).

## Steps
1. Search the repo, its CI and infra config for PaperCut NG/MF. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-81578") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-81578 https://nvd.nist.gov/vuln/detail/CVE-2026-82078 https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/ https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4
https://pwned.coffee/i/papercut-ng-mf-unsafe-reflection-vulnerability

Sources

Totalone hot coffee