CISA added both PaperCut zero-days to the Known Exploited Vulnerabilities catalog on August 31 and, the same afternoon, rewrote its own assessment of them from “none” to “active.”
What happened
CISA added CVE-2026-81578 and CVE-2026-82078, the two chained PaperCut NG/MF flaws, to the Known Exploited Vulnerabilities catalog on August 31, 2026. Both carry a federal remediation deadline of September 14, 2026.
Those dates come from the NVD records, which republish CISA’s own catalog fields verbatim. CVE-2026-81578 carries a cisaExploitAdd of 2026-08-31 and a cisaActionDue of 2026-09-14, under the catalog name “PaperCut NG/MF Missing Authentication for Critical Function Vulnerability.” CVE-2026-82078 carries the identical pair of dates under the name “PaperCut NG/MF Unsafe Reflection Vulnerability.”
The more consequential change is one the catalog does not advertise. On August 29 this site reported that CISA’s own SSVC assessments of both CVEs, published through its Vulnrichment program, recorded Exploitation: none — written a day after PaperCut told customers they were under attack. Those assessments have now been rewritten. Both records were updated at 3:25 p.m. UTC on August 31, minutes apart, and both now read Exploitation: active.
The rewritten records also expose, for the first time, how CISA scores the two flaws on the variables that drive a federal deadline. They do not match each other:
- CVE-2026-81578 — Exploitation: active. Automatable: yes. Technical Impact: partial.
- CVE-2026-82078 — Exploitation: active. Automatable: no. Technical Impact: total.
Two of the four variables that BOD 26-04 uses to derive a deadline are inverted between the two records, and both CVEs landed on the same September 14 date.
The required-action text differs, though, and the difference is specific. For CVE-2026-82078, the catalog says: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use if mitigations unavailable.”
For CVE-2026-81578, it says: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s ‘Forensics Triage Requirements’. Follow applicable BOD 26-04 guidance for cloud services or discontinue use if mitigations unavailable. Stakeholders must evaluate internet exposure and ensure BOD 26-04 patch compliance.”
The flaw CISA rates automatable is the one that carries a forensic-triage obligation. The flaw it rates as causing total technical impact does not.
The NVD records disagree with themselves on severity in a second way. On CVE-2026-81578, NVD’s primary CVSS v3.1 score is 9.8 with a vector of C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability. NVD’s own CVSS v4.0 secondary score on the same record is 8.8, with VC:L/VI:H/VA:L — limited confidentiality impact, high integrity impact, limited availability impact. The record’s written description supports the second reading, not the first: it says the flaw “allows an unauthenticated remote attacker to modify certain system configurations.” CVE-2026-82078 carries 9.1 under v3.1 and 9.4 under v4.0.
Exploit tooling is public. Rapid7 pull request #21842 against the Metasploit Framework, opened August 28 and still open at the time of this check, adds a module named multi/http/papercut_ng_external_user_lookup_rce that chains both CVEs, covers the 24.x, 25.x, and 26.x branches, and explicitly bypasses PaperCut’s first emergency patch. Its authors report testing to SYSTEM-level access on Windows.
Why it matters
The first thing here is the correction, and it should be read as a correction working rather than a failure. Three days ago CISA’s machine-readable assessment of these two CVEs said exploitation was not occurring, at a moment when the vendor had already published an urgent bulletin and researchers were reporting intrusions. That gap is the sort of thing a compliance queue consumes silently: an agency filtering on SSVC exploitation values would have deprioritized both flaws on the strength of a field that was wrong. It is now right. The record moved in under 72 hours, and the KEV addition followed the same afternoon. That is a reasonable turnaround for a government process, and it is worth saying so plainly, because this publication spent Saturday saying the opposite.
The second thing is harder to be comfortable with. BOD 26-04 derives its deadlines from four binary variables — internet exposure, KEV listing, exploit automation, and total versus partial technical impact — and sorts the result into three-day, 14-day, 60-day, and deferred bands. CISA has now published its own values for two of those variables on both CVEs, and they differ from each other on both. One flaw is automatable with partial impact; the other is not automatable with total impact. Under a scheme that treats those variables as inputs, the two records ought to produce different outputs, or the scheme ought to explain why they do not. Both produced September 14.
There is a defensible reading in which nothing is wrong. Internet exposure is the variable CISA cannot evaluate centrally — it depends on how each agency has deployed the software — and the required action for CVE-2026-81578 tells stakeholders to “evaluate internet exposure” themselves. On that reading, the catalog date is an outer bound and an exposed asset carries a shorter clock the agency has to work out on its own. But the directive’s confirmed text ties the forensic-triage obligation specifically to the short band: it says the phrase “& forensic triage” means the agency must complete remediation “within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.” The catalog entry pairs that obligation with a fourteen-day date.
This publication cannot resolve that, and will not pretend to. The authoritative schedule mapping variable combinations to deadline bands is Table 1 of the directive, published in Appendix A as PNG images with no alt text. The vendors who transcribed it by eye disagree with each other about which combinations earn three days. So the honest statement is the narrow one: CISA’s catalog assigns a forensic-triage requirement alongside a fourteen-day date, the directive’s prose associates forensic triage with a three-day timeline, and no machine-readable version of the table exists to settle which controls. An agency reading its own KEV feed cannot answer this question either. That is the reportable part.
The severity split on CVE-2026-81578 matters for a more ordinary reason: 9.8 and 8.8 will not produce the same behavior in a ticketing system, and shops that gate on a 9.0 threshold will treat the same flaw differently depending on which of NVD’s two scores their tooling ingests. The v4.0 vector and the written description agree that the direct impact is configuration modification. The chain is what turns that into code execution — CVE-2026-82078’s v3.1 vector requires high privileges, and CVE-2026-81578 is what supplies them. Neither score describes the chain, because CVSS scores flaws, not chains. Anyone triaging these individually will underrate them.
What to do
Upgrade PaperCut MF and NG to 24.1.10, 25.0.13, or 26.0.5, matching your branch. Those are the fixed versions in the NVD configuration data. The first emergency patch PaperCut shipped is bypassed by public tooling; if you applied a patch before August 28, confirm which one you have rather than assuming you are covered.
Federal civilian agencies have until September 14 on both CVEs, and the CVE-2026-81578 entry adds a forensic-triage obligation on top of remediation. Given the ambiguity described above, the conservative reading is to treat any internet-exposed PaperCut server as carrying the shorter clock and the triage requirement together.
PaperCut’s web interface commonly listens on port 9191. Anything reachable from outside your network on that port should be assumed to have been probed. Check for administrative configuration changes you did not make, particularly to database connection parameters — that is the mechanism CVE-2026-82078 abuses to load arbitrary Java bytecode — and for remote access tooling and persistence on the print server itself, which is where reported intrusions have gone next.
Sourcing note
Checked: NVD records for CVE-2026-81578 and CVE-2026-82078, which republish CISA’s catalog fields verbatim; the CISA Vulnrichment SSVC records for both CVEs in the cisagov/vulnrichment repository; Rapid7’s Metasploit pull request #21842. All KEV dates in this story are taken from NVD, not from coverage.
Could not reach: cisa.gov returns 403 to automated fetching, so the KEV catalog page and the BOD 26-04 text were not read directly on this run; the KEV dates and required-action language here come from NVD’s republication of them, and the directive language is quoted from this publication’s prior verified reading. A copy of the KEV catalog JSON mirrored on GitHub was still at catalog version 2026.08.27 when checked and did not yet contain these entries, which is a mirror lag, not a discrepancy in the catalog. PaperCut’s security bulletin of August 27 returned only page navigation to automated fetching on this run; affected and fixed version numbers here come from NVD’s configuration data rather than the vendor page.
Unresolved: whether the fourteen-day deadline on CVE-2026-81578 is consistent with the forensic-triage requirement attached to it, which cannot be checked because the authoritative table is published only as images. The reported escalation from reconnaissance to hands-on-keyboard intrusion is attributed to watchTowr in trade coverage; watchTowr’s own research blog carried no PaperCut writeup at the time of this check, so that characterization is single-sourced through a secondary outlet and is not the basis for anything stated above. A figure of more than 1,000 internet-exposed PaperCut instances circulating in coverage is credited to Shadowserver; it was not verified against Shadowserver’s own dashboard on this run.
Prior coverage: the initial disclosure, the second emergency patch, and the SSVC “none” assessment now superseded.