Listen to this Post
CVE ID: CVE-2026-82078
Intro:
CVE-2026-82078 is a critical unsafe dynamic class loading vulnerability present in the database connection utilities of PaperCut MF and PaperCut NG. The core of the flaw lies in how the application handles Java Database Connectivity (JDBC) drivers. To support various database backends like MySQL, PostgreSQL, or Oracle, PaperCut allows the database driver class to be specified via a configurable parameter. However, the application instantiates these driver classes based on the provided driver name without validating it against an allowlist of approved drivers.
This lack of validation creates a significant attack surface. If an attacker can manipulate system configuration parameters, they can specify any fully qualified Java class name that exists on the application’s classpath. Using Java’s reflection mechanisms, the PaperCut server process will then load and instantiate this arbitrary class. Because Java’s class loading mechanism can execute static initializers and constructors upon instantiation, this allows the attacker to execute arbitrary Java bytecode.
The vulnerability is classified under CWE-470 (Use of Untrusted Input in Reflection) and aligns with CWE-94 (Code Injection). The execution occurs under the security context of the PaperCut server process, which often runs with elevated system privileges to manage print queues and integrate with Active Directory. This effectively grants the attacker full control over the underlying operating system, enabling lateral movement, data exfiltration, and backdoor installation.
The severity is compounded by the fact that this vulnerability can be chained with CVE-2026-81578, an improper access control vulnerability. CVE-2026-81578 allows an unauthenticated remote attacker to modify server configurations. By chaining these flaws, an attacker can bypass authentication and then exploit CVE-2026-82078 to achieve unauthenticated remote code execution (RCE). Active exploitation in the wild has been observed, with attackers executing commands like `whoami` and `ver` to profile compromised systems.
DailyCVE Form:
Platform: PaperCut MF/NG
Version: Prior Aug 27, 2026
Vulnerability: Unsafe Dynamic Class Loading
Severity: CRITICAL (9.4)
Date: August 28, 2026
Prediction: Emergency Patch Available
What Undercode Say:
Analytics from active exploitation campaigns reveal attackers are chaining CVE-2026-82078 with CVE-2026-81578. Huntress researchers observed attackers executing base64-encoded reconnaissance commands, including `whoami` and ver, to identify the user account and operating system version. In one incident, a hex-encoded Java `.class` file was deployed to profile the system and obtain directory listings, outputting data to a file named Udydn.out. Another campaign utilized a `.class` payload to execute `tasklist` alongside `whoami` and `ver` commands. watchTowr researchers demonstrated a proof-of-concept using an SMB2 share to deliver a Derby archive, achieving unauthenticated RCE with system privileges under the `pc-app.exe` process.
Reconnaissance commands observed in the wild: whoami ver tasklist Example of decoding base64-encoded commands from logs: echo "d2hvYW1p" | base64 -d Checking PaperCut version and patch level (Linux): cat /opt/papercut/server/lib/pc-app.version Checking PaperCut version and patch level (Windows): type "C:\Program Files\PaperCut MF\server\lib\pc-app.version"
Exploit: (Educational Purposes!)
Exploitation typically begins by leveraging CVE-2026-81578 to bypass authentication and modify the server’s configuration. An unauthenticated attacker sends a crafted request that tricks PaperCut’s authorization checks, allowing them to change the database driver configuration to a malicious class name. Once the configuration is altered, the attacker triggers the class loading mechanism. The PaperCut server then instantiates the specified malicious Java class, executing its bytecode. This can be a Java class designed to run system commands, establish a reverse shell, or deploy further malware. The exploit is executed under the security context of the PaperCut Application Server service, typically `pc-app.exe` on Windows, which often runs with high privileges.
Protection:
- Apply Emergency Patches Immediately: Upgrade to the latest emergency patch releases for PaperCut NG/MF versions 24, 25, and 26. PaperCut released a second emergency patch (Emergency Patch Release 2) on August 28, 2026, to address bypasses of the initial fix.
- Restrict Web Access: Limit access to the PaperCut Application Server’s web management interface to trusted networks only.
- File System Hardening: Restrict write permissions on directories containing application libraries to prevent attackers from placing malicious classes on the classpath.
- Configuration Validation: If patching is not immediately possible, implement strict allowlisting for database driver class names, permitting only known-safe JDBC drivers like
com.mysql.cj.jdbc.Driver. Ensure input validation is applied at all layers accepting configuration changes.
Impact:
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the PaperCut server process. This can lead to complete compromise of the server, including data theft (user credentials, print logs), installation of backdoors, and lateral movement within the network. When chained with CVE-2026-81578, the attack becomes remotely exploitable without authentication, posing a severe risk to all unpatched PaperCut instances.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
