6 minhigh
CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-81578, CVE-2026-82078)
CISA added two actively exploited vulnerabilities affecting PaperCut NG/MF to its Known Exploited Vulnerabilities Catalog. CVE-2026-81578 is a missing authentication for critical function vulnerability and CVE-2026-82078 is an unsafe reflection vulnerability. Federal agencies are required to remediate these under BOD 26-04, and CISA recommends all organizations prioritize patching.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2026-81578Missing authentication for critical function vulnerability allows attackers to access sensitive functionality without valid credentials.
- cveCVE-2026-82078Unsafe reflection vulnerability allows attackers to execute arbitrary code or manipulate application logic through crafted input.
Detection / Hunteropenrouter
What Happened
CISA has confirmed that attackers are actively exploiting two security flaws in PaperCut NG and PaperCut MF, which are print management software products used by many organizations. One flaw lets attackers bypass login requirements to reach sensitive functions. The other flaw lets attackers run unauthorized code by manipulating how the software processes certain inputs. Federal agencies are required to fix these issues quickly and check whether their systems were already compromised. CISA advises all organizations to apply available patches as soon as possible and to verify that no prior exploitation occurred.
Key Takeaways
- CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
- Both vulnerabilities affect PaperCut NG/MF: one is a missing authentication for critical function flaw and the other is an unsafe reflection vulnerability.
- Federal Civilian Executive Branch agencies are required by BOD 26-04 to remediate these vulnerabilities on exposed assets and check for prior compromise.
- CISA encourages all organizations, not just federal agencies, to prioritize remediation of KEV Catalog vulnerabilities.
Affected Systems
- PaperCut NG
- PaperCut MF
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-81578 | PaperCut NG/MF | Missing authentication for critical function vulnerability allows attackers to access sensitive functionality without valid credentials. | |
| CVE-2026-82078 | PaperCut NG/MF | Unsafe reflection vulnerability allows attackers to execute arbitrary code or manipulate application logic through crafted input. |
Attack Chain
- Initial Access: Attacker exploits CVE-2026-81578 to access critical PaperCut NG/MF functionality without authentication
- Execution: Attacker leverages CVE-2026-82078 unsafe reflection to execute arbitrary code or manipulate application behavior
- Persistence: Attacker may establish persistence on the compromised PaperCut server
- Impact: Attacker gains total control of the affected asset
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in this article. It is a CISA KEV catalog addition notice.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR may detect post-exploitation activity on the PaperCut server such as unusual process execution or file modifications. The initial exploitation of the vulnerabilities occurs at the application layer and may not produce EDR-visible telemetry without application-specific logging. |
| Network Visibility | Medium | Network monitoring may detect anomalous HTTP requests to PaperCut NG/MF endpoints. Visibility depends on whether the PaperCut instance is internet-facing and whether TLS inspection is in place. |
| Detection Difficulty | Moderate | Detecting exploitation of these vulnerabilities requires application-level logging from PaperCut NG/MF. Generic EDR or network telemetry may not capture the initial exploitation without tuning. Post-exploitation activity is more likely to be detected by standard EDR capabilities. |
Required Log Sources
- PaperCut NG/MF application logs
- Web server access logs
- EDR process execution logs
- Network flow data
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unauthenticated access to critical PaperCut NG/MF administrative endpoints that would normally require authentication, leveraging T1190 indicators. | PaperCut application logs, web server access logs | Initial Access | Medium — legitimate administrative access patterns may generate similar log entries. |
| Consider hunting for unexpected process execution or file creation on PaperCut servers following anomalous web requests, indicating successful exploitation of the unsafe reflection vulnerability. | EDR process execution logs, file creation events | Execution | Low — unexpected child processes of the PaperCut service are unlikely in normal operation. |
| Consider hunting for signs of post-exploitation activity such as new scheduled tasks, services, or unusual network connections originating from PaperCut servers. | EDR telemetry, network flow data, Windows Event Logs | Persistence and Lateral Movement | Low to Medium — depends on the normal operational profile of the PaperCut server. |
Control Gaps
- Application-layer WAF rules may not detect exploitation of missing authentication or unsafe reflection flaws without specific signatures.
- Network-based detection without TLS inspection will miss exploitation of HTTPS-exposed PaperCut instances.
- EDR without application-specific context may not flag the initial exploitation as malicious.
Key Behavioral Indicators
- HTTP requests to PaperCut administrative endpoints without preceding authentication events
- Unexpected child processes spawned by the PaperCut service account
- New files or scheduled tasks created on PaperCut servers
- Outbound network connections from PaperCut servers to unfamiliar IP addresses
False Positive Assessment
Low — exploitation of missing authentication and unsafe reflection vulnerabilities on PaperCut NG/MF instances is unlikely to occur during normal operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Identify all PaperCut NG and PaperCut MF instances in your environment, including those that are internet-facing.
- Apply vendor patches for CVE-2026-81578 and CVE-2026-82078 as soon as possible, prioritizing externally exposed instances.
- If patching is delayed, consider restricting network access to PaperCut management interfaces to trusted IP ranges only.
- Review PaperCut application and web server logs for evidence of prior exploitation, focusing on unauthenticated access to critical functions and anomalous requests.
Infrastructure Hardening
- Evaluate whether PaperCut management interfaces need to be exposed to the internet. If not, consider placing them behind a VPN or zero-trust network access solution.
- Consider implementing WAF rules specific to PaperCut NG/MF if the application must remain internet-facing.
- Ensure PaperCut servers are included in vulnerability scanning schedules and patch management workflows.
User Protection
- Ensure PaperCut service accounts operate with least privilege to limit the impact of successful exploitation.
- Consider enabling enhanced application logging in PaperCut NG/MF if available to improve detection capabilities.
Security Awareness
- Consider notifying IT teams responsible for print management infrastructure about these vulnerabilities and the urgency of patching.
- If applicable, incorporate KEV Catalog monitoring into existing vulnerability management processes so newly added entries trigger automated prioritization.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
Privilege Escalation
Related
Stay currentSubscribe via RSS
