---
id: CVE-2026-82078
title: 'PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector'
summary: >-
  An unsafe dynamic class loading vulnerability exists in the database
  connection utilities of PaperCut MF and PaperCut NG. The application
  instantiates database driver classes based on configurable driver names
  without validating against …
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-470
vendor: PaperCut
product: PaperCut MF/NG
affected:
  - mf_ng < 24.1.10
  - mf_ng >= 25.0.0 < 25.0.13
  - mf_ng >= 26.0.0 < 26.0.5
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-28T00:00:00+00:00'
exploited: true
exploitAvailable: true
published: '2026-08-28'
updated: '2026-09-13'
sourceUpdated: '2026-09-13T23:16:32.332Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-82078'
references:
  - url: >-
      https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
tags:
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
epss: 0.03574
epssPercentile: 0.88875
kev: true
kevDateAdded: '2026-08-31'
kevDueDate: '2026-09-14'
kevRansomware: false
exploits:
  metasploit:
    - exploit/multi/http/papercut_ng_external_user_lookup_rce
  checkedAt: '2026-09-21T15:30:52.122Z'
ingestedAt: '2026-09-14T15:23:07.468Z'
---

## Overview

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

## Affected

- `mf_ng < 24.1.10`
- `mf_ng >= 25.0.0 < 25.0.13`
- `mf_ng >= 26.0.0 < 26.0.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.