PaperCut MF and PaperCut NG — print management software already infamous in security circles for a 2023 vulnerability that ransomware operators used to breach dozens of organisations — had two more vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue on the same day, 31 August 2026.
CVE-2026-81578, CVSS 9.8, is an improper access control vulnerability in the web management interface. Per NVD, under specific conditions, unauthenticated remote requests targeting the interface can succeed where authentication should have been required. CVE-2026-82078, CVSS 9.1, is unsafe dynamic class loading in the application's database connection utilities — the software instantiates a database driver class based on input that an attacker can influence, which is a route to loading and running a class the application never intended to load.
The specific history that makes this pair worth reading closely
PaperCut's name carries weight in vulnerability discussions for a reason: CVE-2023-27350, a PaperCut MF/NG authentication bypass, was mass-exploited by ransomware affiliates in 2023 in one of the more widely documented print-server compromise campaigns of that year. That history does not tell us anything about whether these two new 2026 CVEs will be used the same way — NVD does not flag either with a confirmed ransomware association at the time of writing, and this post makes no claim that they have been. What the history does establish is that PaperCut servers are a known, previously-proven target category, sitting in the same network position — often domain-joined, often print-spooler-privileged — that made the 2023 campaign effective.
Why print management software is a disproportionate target
Print servers are usually treated as low-priority infrastructure: unglamorous, rarely the subject of a dedicated security review, and frequently granted domain permissions nobody has revisited since the software was installed. That combination — low attention, high privilege — is exactly what made the 2023 campaign work, and it is unrelated to whether the specific bug is an authentication bypass or, as with CVE-2026-82078, an unsafe class-loading flaw. The access control failure in CVE-2026-81578 removes the front door; the class-loading issue in CVE-2026-82078 is a second, independent path once any level of interaction with the database layer is possible.
The specific mechanics, and why they compound
CVE-2026-81578's improper access control is the more urgent of the two on its own: an unauthenticated request against the web management interface succeeding where it should be rejected is, functionally, no authentication requirement at all under the right conditions. CVE-2026-82078 is subtler — unsafe dynamic class loading means the application takes some input, uses it to decide which Java (or equivalent) class to instantiate for a database driver, and doesn't sufficiently restrict which classes are eligible. An attacker who can influence that input can potentially cause the application to load a class that was never meant to be reachable this way, which is a well-established route to code execution when the loaded class can be controlled or substituted.
Individually, either bug is serious. Together, disclosed on the same day against the same product, they read as what a security review of the same codebase is likely to produce: one clear-cut access-control gap, and one more structural weakness in how the application handles class instantiation that a determined attacker could plausibly chain with the first.
What to check this week
Patch both CVEs together — they were disclosed on the same day against the same product, and treating them as a single remediation event rather than two separate tickets keeps the fix from being applied to one code path while the other stays open.
Audit what domain privileges your PaperCut service accounts actually hold. This is the lesson the 2023 campaign already taught the industry once: the print server itself is rarely the target worth stealing data from directly — what makes it dangerous is what it's trusted to do on the domain.
Confirm the web management interface is not reachable from the general network. CVE-2026-81578 is an access-control failure specifically in that interface; removing its exposure removes the precondition regardless of patch timing.
Don't wait for a confirmed ransomware flag to treat this with urgency. CISA's KEV listing already means confirmed exploitation in the wild — the ransomware flag is additional context, not the bar for action.
How Safeguard helps
Safeguard's continuous inventory tracks infrastructure like print management servers with the same rigor as customer-facing applications, specifically because — as PaperCut's history demonstrates — attacker value and organisational attention are frequently inversely related for this category of software. Reachability analysis identifies whether a vulnerable interface like PaperCut's web management console is actually exposed to a path an attacker could use, turning "we run PaperCut somewhere" into a concrete, checkable answer before the next CVE against it arrives.
