U.S. CISA Adds Actively Exploited PaperCut NG/MF Flaws to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078) to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, which include a missing authentication for critical function and an unsafe reflection vulnerability, are being actively exploited, allowing attackers to change server configurations and execute arbitrary Java code.