Skip to content
Hermes Codex

CVE-2026-82078: PaperCut NG/MF Database Dynamic Class Loading RCE

HERMES

HERMES THREAT SCORE & JAVA REFLECTION EXECUTION VECTOR

Target: PaperCut NG/MF Application Server (DatabaseUtils / pc-app.exe)
Confidence: 99%
96 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-82078 at 9.4 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns an operational score of 96 (CRITICAL) due to automated exploitation in the wild by AI agent swarms and SYSTEM privilege execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-82078: PaperCut NG/MF Database Dynamic Class Loading RCEVULNERABILITY

Connected Nodes: 4
Active Relationships (Outgoing)
99% VERY_HIGH

Enterprise print management and document tracking platform deployed widely across education and corporate networks.

🔍 Why is this related? (Evidence & Provenance)

“Directly confirmed by PaperCut Security Bulletin and chained in RCE attacks.”

Supporting Verified Evidence:
→ affectsPRODUCTPaperCut MF/NG
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in PaperCut MF/NG documented in Hermes dossier.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:
Inbound Associations (Incoming)
99% VERY_HIGH

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”
ParameterTechnical SpecificationThreat Intelligence Context
CVE IdentifierCVE-2026-82078PaperCut Security Advisory & CISA KEV
Affected Productpapercut:papercut_ng_mfPrint Management Application Server
Vulnerable ComponentDatabaseUtils / Driver Class LoaderDatabase Connection Manager (pc-app.exe)
Weakness ClassCWE-470: Use of Externally-Controlled Input to Select Classes or CodeUnsafe Reflection / Dynamic Code Execution
CVSS v3.1 Score9.4 (CRITICAL / Hermes Score 96)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed Versions24.1.10, 25.0.13, 26.0.5Official Emergency Patch Release 3
MITRE ATT&CKT1190 - Exploit Public-Facing Application, T1059.007 - JavaScript / JavaInitial Access / Execution
Campaign LinkAI-Orchestrated PaperCut Campaign440+ enterprise environments compromised

2. In-Depth Technical Decomposition & Root Cause

Section titled “2. In-Depth Technical Decomposition & Root Cause”

During database connection initialization or reconfiguration, PaperCut dynamically loads JDBC driver classes using Java reflection based on configuration properties stored in the application database/config files:

// Vulnerable class loading logic in DatabaseUtils.java (decompiled representation)
public static Connection initDatabaseConnection(ServerConfig config) throws Exception {
    String driverClassName = config.getProperty("database.driver");
    String jdbcUrl = config.getProperty("database.url");


    /* VULNERABILITY (CVE-2026-82078 / CWE-470):
     * The application instantiates the driver class directly using Class.forName()
     * without validating the class against an allowlist of approved JDBC drivers.
     * When chained with CVE-2026-81578, an attacker supplies an arbitrary class
     * or a malicious JDBC driver URL that triggers remote bytecode execution. */
    Class<?> driverClass = Class.forName(driverClassName);
    Driver driver = (Driver) driverClass.getDeclaredConstructor().newInstance();
    DriverManager.registerDriver(driver);


    return DriverManager.getConnection(jdbcUrl);
}

When an attacker changes database.driver to a malicious gadget class or a rogue JDBC URL, Java executes static initializers or network callbacks, achieving native code execution within pc-app.exe.

3. Attack Scenarios & Threat Modeling

Section titled “3. Attack Scenarios & Threat Modeling”
  1. Initial Bypass: Attacker exploits CVE-2026-81578 to set database.driver to an attacker-controlled payload class.
  2. Reflection Trigger: The PaperCut Application Server invokes initDatabaseConnection().
  3. Execution as SYSTEM: The malicious class executes under NT AUTHORITY\SYSTEM, spawning shells or helper utilities (lsa_read.exe, save_hives.exe).
  4. Active Directory Escalation: The attacker leverages local SYSTEM privileges to execute noPac (CVE-2021-42278 & CVE-2021-42287) or dump LSASS memory.

4. Forensic Detection & Log Signatures

Section titled “4. Forensic Detection & Log Signatures”

Database Error Indicators

Inspect [PaperCut-Dir]\server\logs\server.log for: ERROR No suitable driver found for jdbc:no:x or ERROR DatabaseUtils - Database error looking up cardID.

Process Tree Monitoring

Look for child processes spawned by pc-app.exe: pc-app.exe -> cmd.exe /c reg save HKLM\SYSTEM ...

5. Remediation & Hardening Guidelines

Section titled “5. Remediation & Hardening Guidelines”
  1. Deploy Emergency Update: Install PaperCut 24.1.10, 25.0.13, or 26.0.5.
  2. Review Campaign Intelligence: Consult our analysis of the AI-Orchestrated PaperCut Campaign.