Blast radius: what one CVE actually reaches

Every CVE arrives as a headline and a CVSS score. Neither tells you what actually breaks in your environment. Blast-radius analysis answers what a headline cannot: given this specific bug on this specific host, what does an attacker reach on the second hop, the third, and the fifth?

This post works through that exercise using a currently exploited chain (added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-31) against a generic reference architecture with example.com placeholders. The goal is a repeatable method, not a scary story.

The chain in one paragraph

CVE-2026-81578 is a missing-authentication-for-critical-function bug in PaperCut NG/MF: an unauthenticated remote attacker can modify certain system configuration values. On its own, that is a configuration-tampering primitive. CVE-2026-82078 is an unsafe-reflection bug in the same product: an attacker who can influence configuration parameters can coerce the server to invoke arbitrary Java bytecode already resident on the application classpath, executing under the security context of the PaperCut server process. Chained, the two turn an unauthenticated network request into code execution as the PaperCut service account. Both entries are on the KEV list, meaning CISA has evidence of exploitation in the wild.

Blast-radius analysis exists to answer what that description leaves out: what any of it reaches.

The reference architecture

Assume a typical mid-size deployment. print.example.com runs PaperCut NG/MF on Windows, joined to corp.example.com. The service runs under a domain account, svc-papercut@corp.example.com, so the print server can enumerate users and enforce quotas against dc01.corp.example.com. Print jobs land on an SMB share on files.example.com. Cost-recovery reporting writes to a Microsoft SQL Server on sql.example.com using integrated authentication. Egress from the print VLAN is allowed to a handful of vendor update endpoints and, importantly, to proxy.example.com on 443 for general web traffic. Monitoring runs an agent on the host and forwards Windows Security and Sysmon channels to a SIEM.

Not an unusual layout. This is what "we run a print server" means in practice.

First-hop reach: the process itself

Under the chained exploit, the attacker executes Java bytecode as the PaperCut process. That process holds, at minimum:

This is what the CVE gives you. Everything after is a function of the environment, not the bug.

Second-hop reach: identity and lateral paths

The PaperCut service account is where blast radius stops being about a print server. If svc-papercut was provisioned with domain-wide read on user objects (a common choice to make quotas and reports work), the attacker gains an authenticated LDAP view of every account, group nesting, and service principal name in corp.example.com. That feeds Kerberoasting and BloodHound enumeration at once.

Integrated auth into sql.example.com means the attacker inherits whatever role svc-papercut holds on the reporting database. If that role has db_owner for convenience, the second hop reaches production data. If SQL Server itself is unpatched against something like CVE-2019-1068 (also on the KEV list), a follow-on RCE against the database service account becomes possible.

Write access to the SMB share on files.example.com lets the attacker drop payloads inside a location that other users open by habit. That is a low-effort watering hole, not a theoretical one.

Third-hop reach: what the network allows

Egress to proxy.example.com on 443 is the quiet third hop. It gives the attacker a stable command-and-control channel that looks like the rest of the office. Any allow-listed vendor update endpoint that resolves through a CDN is a candidate for domain-fronted exfiltration if the SIEM does not decode SNI and JA4 fingerprints.

At this point the CVE has "reached" identity, a database, a file share, and the internet. None of that is in the advisory. All of it is in the architecture.

Verifying the reach, not just the patch

A patch tells you the bug is closed on the host you patched. It does not tell you whether the blast radius shrank. Two things need verification.

First, that the exploit primitive is gone on every instance. The snippet below is a safe reachability probe against your own inventory. Run it only where you have authorization, and pair it with the vendor's patch-verification KB rather than treating a status code as proof:

# Enumerate PaperCut admin surfaces from an internal scanner.
# Replace the target list with your own asset inventory.
while read host; do
  code=$(curl -sk -o /dev/null -w '%{http_code}' \
    --max-time 5 \
    "https://${host}:9192/app?service=page/SetupCompleted")
  echo "${host} ${code}"
done < papercut-hosts.txt | tee papercut-reachability.txt

# Any 200 on an already-configured server warrants investigation.
# Follow up by grepping server.log for reflection calls invoking
# classes outside the expected package prefixes, and confirm the
# fixed build number against the vendor advisory.

Second, that the second- and third-hop paths are what you thought they were. That means pulling the effective permissions of svc-papercut in AD, the effective SQL role on sql.example.com, the share ACL on files.example.com, and the actual egress ACL on the print VLAN, then diffing them against the design document. In most environments, the diff is not zero.

Doing this before the next KEV entry

Blast-radius analysis is boring on purpose. It is inventory, identity, and network reachability, refreshed often enough that the answer for the next CVE is a query, not a project. The KEV additions between 2026-08-26 and 2026-08-31 alone span Linux kernel privilege escalation (CVE-2026-53362, CVE-2022-0995), a path-traversal write in JFrog Artifactory (CVE-2026-66384), a Citrix NetScaler memory-buffer bug (CVE-2026-8452), unauthenticated file access in ownCloud (CVE-2023-49105), an AjaxPro deserialization bug in end-of-life .NET components (CVE-2021-23758), and local privilege escalation via ABRT and libuser on older Red Hat systems (CVE-2015-5287, CVE-2015-3246). Each one is a different first hop into the same kinds of second and third hops mapped above.

If the answer to "what does this reach" is a fresh whiteboard session every time, your answer arrives after the attacker's. If it is a query against a graph you already keep current, you get to argue about containment instead of discovery.

Verifiable security.