2 new KEV entries in PaperCut NG/MF

On 2026-08-31, CISA added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, both affecting PaperCut NG/MF print-management servers. They headline this week's additions, but a busy fortnight preceded them: JFrog Artifactory, the Linux kernel, ownCloud, Citrix NetScaler, and Gitea were all flagged as actively exploited between 2026-08-25 and 2026-08-31. What follows covers what the PaperCut pair does, why CISA judged the wider batch exploited in the wild, how to check your fleet's exposure, and what to do before the Binding Operational Directive 22-01 deadline.

The PaperCut chain: unauthenticated config write plus unsafe reflection

Read the two new PaperCut NG/MF entries together; CISA's descriptions explicitly note they chain.

• CVE-2026-81578 is a missing-authentication-for-critical-function flaw: an unauthenticated remote attacker can modify PaperCut system configurations without presenting any credential.
• CVE-2026-82078 is an unsafe reflection flaw. With configuration parameters under attacker control, PaperCut loads and invokes arbitrary Java bytecode already on the application classpath, executing under the PaperCut server process's security context.

The attack sequence: reach the management surface unauthenticated (CVE-2026-81578), rewrite a setting so a reflective code path resolves to an attacker-chosen class (CVE-2026-82078), and execute code as the PaperCut service account. That account typically holds broad access to spool directories and LDAP bind credentials; in Windows deployments it is often over-privileged on the print server itself.

Any PaperCut admin interface not restricted to a management VLAN should be treated as internet-adjacent. Print servers historically live on flat networks reachable from user subnets, the same exposure that drove CVE-2023-27350 and CVE-2023-27351 into KEV in 2023. That history gives CISA grounds to credit exploitation reports on the new chain and add both entries the same day as the advisory.

How to tell whether you are affected

Three checks, in order of cost:

1. Inventory. Confirm every PaperCut Application Server, Site Server, and secondary print server in your estate, including non-production systems. PaperCut is frequently deployed by facilities teams outside IT-managed asset inventories.
2. Version. Compare each instance against the vendor's fixed release. The running build appears in the admin UI's "About" panel and in server.log at startup.
3. Exposure. From an untrusted vantage point, probe TCP/9191 and TCP/9192. Any endpoint that serves the admin login or the /app path from outside the management network warrants an immediate compensating control, not a scheduled patch window.

A minimal detection query against a web-access log (Splunk syntax, adapt as needed) for unauthenticated hits on config endpoints:

index=web sourcetype=papercut:access
    uri_path IN ("/app", "/rpc/api/rest/*", "/admin*")
    status IN (200, 302)
    NOT user_authenticated=true
| stats count values(uri_path) as paths by src_ip, dest_host
| where count > 5

Pair that with a process-tree alert on java.exe or pc-app spawning cmd.exe, powershell.exe, wscript.exe, bash, or sh. PaperCut's normal operation almost never requires those child processes; any match warrants analyst review.

The rest of the two-week batch

CISA's KEV additions from 2026-08-25 through 2026-08-31 span multiple vendors. Grouped by impact area:

Developer and build infrastructure:

• CVE-2026-66384 (JFrog Artifactory): authenticated path traversal that lets a credentialed user write data outside the intended Docker cache directory under specific remote-repository conditions. Exploitation requires credentials; treat CI service accounts, forgotten integration tokens, and shared build users as the realistic entry points.
• CVE-2026-60004 (Gitea): a repository writer can POST a crafted patch to the diffpatch API endpoint, plant an executable Git hook, and obtain shell as the Gitea service account. If your Gitea instance federates identity through a broader SSO, repository write is a far lower bar than server admin.

Operating system and platform:

• CVE-2026-53362 (Linux kernel): privilege escalation via the IPv6 networking subsystem, affecting distributions built on the affected kernel line, including several enterprise families.
• CVE-2022-0995 (Linux kernel): out-of-bounds write enabling local privilege escalation or denial of service. The 2022 CVE ID is a reminder that old does not mean safe; unpatched long-lived VMs are the target profile.
• CVE-2015-5287 (ABRT) and CVE-2015-3246 (libuser): local privilege escalation on older Red Hat systems, both flagged as potentially end-of-life. Decommission; do not patch.

Edge and identity:

• CVE-2026-8452 (Citrix NetScaler ADC and Gateway): a memory-buffer flaw CISA characterises as denial of service. DoS on an authentication and remote-access gateway is directly weaponisable, even without code execution.
• CVE-2023-49105 (ownCloud): unauthenticated read, write, and delete of any file when the victim's username is known and no signing key is configured. KEV inclusion two years after disclosure confirms stale ownCloud instances remain active targets.

Application and data:

• CVE-2019-1068 (Microsoft SQL Server): remote code execution under the database engine service account. Any SQL host still on an affected build is a KEV liability.
• CVE-2021-23758 (AjaxPro): .NET deserialization RCE, flagged as potentially end-of-life. If AjaxPro still ships in an application you own, the KEV listing requires removal.

Working the BOD 22-01 clock

BOD 22-01 requires federal civilian executive branch agencies to remediate KEV entries by CISA's assigned due date. Private-sector defenders should treat that deadline as a floor, not a ceiling. A practical sequence for the next two weeks:

1. Cross-reference each CVE above against your CMDB and SBOM. Flag any asset that matches, even loosely; version-string false positives cost less than missed hosts.
2. For internet-reachable assets (PaperCut admin surfaces, NetScaler, ownCloud, Gitea, Artifactory), apply compensating controls that day: source-IP allowlists, WAF rules blocking the vulnerable endpoints, or removing the service from the public interface until patched.
3. For local-privilege-escalation entries (the two Linux kernel CVEs, the two 2015 Red Hat CVEs), prioritise multi-tenant hosts and any system where an untrusted user can obtain a shell.
4. Pull 30 days of authentication, admin-endpoint, and process-execution logs for each affected product and search for patterns consistent with each CVE's mechanics. KEV inclusion means active exploitation; assume compromise until logs say otherwise.
5. Record what you patched, what you decommissioned, and what you accepted as risk, with dates. That paper trail converts a KEV response from a reactive incident into a repeatable control.

The pattern across this batch is unglamorous: internal-facing services with weak network isolation, long-lived hosts that missed a kernel update, and end-of-life software running because nothing broke. None of it is novel. All of it is exploited.

Verifiable security.