CVE-2026-82078Critical· 9.4▾ Hadal⚠ Exploited in the wildPoC availableAn unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against …
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 51.7 · likelihood 0.7 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Federal remediation due Sep 14, 2026
Last analysed / modified upstream
1.7%
1.7% → 3.6%
Metasploit ×1 (last check)
Added to the CISA catalog on Aug 31, 2026. Federal remediation due Sep 14, 2026. View catalog ↗
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
mf_ng < 24.1.10mf_ng >= 25.0.0 < 25.0.13mf_ng >= 26.0.0 < 26.0.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81578Critical· 9.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server
CVE-2026-78030Critical· 9.8DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a mo…
CVE-2026-93762Critical· 9.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents
CVE-2026-93765Critical· 9.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code
CVE-2026-10853High· 7.5IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.