CISA’s own machine-readable assessments of both PaperCut CVEs, timestamped August 28, 2026, record the exploitation status as “none” — a day after PaperCut told customers they were under attack, and hours before the vendor shipped its second emergency patch.
What happened
NVD published CVE-2026-81578 and CVE-2026-82078 on August 28, 2026. Both records carry an SSVC block attributed to source UUID 134c704f-9b21-4f2e-91b3-4a467353bcc0, role “CISA Coordinator,” version 2.0.3 — NIST republishing CISA’s own decision-point values, the same relay that carries the KEV fields.
For CVE-2026-81578, the improper access control flaw in the PaperCut web management interface: SSVC timestamp 2026-08-28T00:12:00 a.m.+00:00, Exploitation none, Automatable yes, Technical Impact partial. For CVE-2026-82078, the unsafe dynamic class-loading flaw: SSVC timestamp 2026-08-28T15:35:13.512853Z, Exploitation none, Automatable no, Technical Impact total.
Set those timestamps against the public record of the same week. On August 27, 2026 PaperCut published an urgent bulletin telling customers they were being attacked through its NG and MF print servers. Huntress published its analysis on August 28, updated 2:45 p.m. Eastern, stating: “Huntress has found evidence of exploitation in two customer environments,” the first on August 26, the second on August 27. Huntress describes PaperCut’s August 27 advisory as saying attackers are actively exploiting a pre-authentication remote code execution flaw “with confirmed customer incidents.” PaperCut then shipped Emergency Patch Release 2 on August 28 at approximately 2:45 p.m. Eastern — 6:45 p.m. UTC.
The CVE-2026-82078 assessment is stamped 3:35 p.m. UTC on August 28. That is roughly a day after the vendor’s own confirmation of attacks, and roughly three hours before the vendor shipped its second emergency patch. It reads “Exploitation: none.”
Neither CVE appears in the Known Exploited Vulnerabilities catalog. Neither record carries a cisaExploitAdd, a cisaActionDue, or any other KEV field. As of this writing there is no federal deadline attached to either.
One further detail: CVE-2026-81578 was last modified on August 29, 2026 at 04:18 UTC. The record was touched today. The exploitation value still reads “none.”
We covered the CVE pair and the patch bypass separately, and that story stands: the two flaws chain into unauthenticated remote code execution, and anyone who applied only the August 27 patch is not protected. This story is about a different field — not the severity scores, which are judgments, but the exploitation flag, which is a claim about the world.
Why it matters
SSVC decision points are not severity opinions. “Exploitation” is meant to answer a factual question: is there evidence this is being used against real systems? The values are defined so that “none” means no evidence of active exploitation and no public proof of concept. That is a statement about the state of the world, and it is checkable. Here the vendor had said the opposite in public a day earlier, and a security firm had published host-level detail.
The difference between this and a disputed CVSS score matters. Reasonable people argue about whether a scope change applies or whether an impact is high or low, and two analysts can score the same bug differently without either being wrong. There is no comparable room here. Either exploitation had been observed by 3:35 p.m. UTC on August 28 or it had not, and the vendor and at least one incident response firm had already said it had.
The most likely explanation is mundane and is worth stating rather than implying something worse: an SSVC assessment is generated at a moment, from the information in front of the analyst, on a CVE record that was hours old and still in Received status. The vendor bulletin that started this named no CVE at all — there was nothing to attach exploitation evidence to until the identifiers existed on August 28. Nothing about the pipeline forces a re-look when the world changes underneath a published value. That is the problem. It is not that someone got it wrong once; it is that the field is written as a snapshot and read as a fact, and nothing in between marks the difference.
The reason this is worth a page rather than a footnote is what these fields feed. BOD 26-04 derives federal remediation deadlines from four binary variables: internet exposure, KEV listing, exploit automation, and whether technical impact is total or partial. Two of those names — automation and total-versus-partial technical impact — are also SSVC decision point names, and the third, KEV listing, is the catalog that exploitation evidence ordinarily drives.
We are not going to tell you which combination earns which deadline, and neither can anyone else with confidence. CISA publishes that mapping as Table 1 in Appendix A of BOD 26-04, as PNG images with no alt text, and the vendors who have transcribed it by eye disagree with one another about which combinations get three days. That is a standing problem we have written about separately. What can be said without the table is narrower and still enough: the inputs to a federally mandated deadline calculation are being published in machine-readable form, at least one of them is a factual claim, and on this pair of CVEs that claim was contradicted by the vendor before it was written.
There is a practical consequence for anyone outside the federal space too. Plenty of private-sector vulnerability programs have adopted SSVC because it is better than sorting by CVSS, and plenty of them ingest the decision points from NVD because that is where they are available in bulk. A queue built that way, on August 28, would have placed both PaperCut CVEs below anything flagged as exploited — while the vendor was shipping its second emergency patch in two days because researchers had bypassed the first one.
The narrower fix is obvious and is a question for CISA rather than for readers: an exploitation value with no expiry and no re-evaluation trigger is a fact-shaped object that decays into a historical note without changing its appearance. The broader point for everyone else is the one we keep arriving at from different directions. The authoritative record is authoritative about when it was written, not about now, and the gap between those two things is where the operational risk lives.
What to do
Patch PaperCut. Emergency Patch Release 2, on August 28, sets the fix boundaries at 24.1.10, 25.0.13 and 26.0.5. If you applied the August 27 builds — 26.0.4 or 25.0.12 — you are not covered; watchTowr found multiple bypasses of that first patch. Version 24, which had no fix when the original bulletin appeared, now has one.
Do not use the SSVC exploitation value in these two records as a triage input. Treat PaperCut NG/MF as actively exploited on the vendor’s own statement of August 27.
More generally: if your vulnerability management tooling consumes SSVC decision points from NVD, check whether it treats Exploitation as a live field or as a timestamped observation, and whether anything in your pipeline re-evaluates it when a vendor publishes an exploitation advisory. If the answer is that a value written once stands until someone edits it upstream, you have inherited this problem. The same applies to any process keyed on KEV membership alone: neither of these CVEs is in KEV, and both are being exploited.
Sourcing note
Checked: NVD API records for CVE-2026-81578 and CVE-2026-82078, retrieved August 29, 2026. All SSVC values, source UUIDs, roles, versions and timestamps quoted above come from those records — NIST republishing CISA’s decision points, a government primary source at one remove. Publication and last-modified timestamps are from the same records.
cisa.gov returns 403 to automated fetching, so we did not read CISA’s own pages. We routed around that by taking the CISA-sourced SSVC block from NVD’s republication, the same method this publication uses for KEV dates. We could not check whether CISA has published an alert of its own on PaperCut, or whether the SSVC values have been revised at the source since NVD last synced.
Exploitation evidence: Huntress’s own writeup, published and updated August 28, 2026, quoted verbatim above. PaperCut’s August 27 bulletin language is taken from Huntress’s account of it and from reporting; we did not retrieve PaperCut’s bulletin directly, and the knowledge base URL we tried returned 404. The patch-bypass finding is attributed to watchTowr via Rapid7 and BleepingComputer, single-sourced to watchTowr’s research.
Unresolved: why the assessments read “none” is not established — we are describing the record, not the reasoning behind it, and we did not put the question to CISA. Whether either CVE has since been added to KEV is not established beyond the NVD records as retrieved. Huntress’s telemetry describes two customer environments; that is the real scale of independently documented exploitation, and it is small. PaperCut has said the attacks “appear limited and targeted.”