{"schema":"vulnpedia.research/1","cve":"CVE-2026-81578","references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","tags":["Patch","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"PaperCut","modified":"2026-09-13T23:15:33.997Z","origins":[{"source":"mitre","sourceId":"PaperCut","modified":"2026-09-13T23:15:33.997Z","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"},{"source":"nvd","sourceId":"CVE-2026-81578","modified":"2026-09-14T00:16:56.207","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}]},{"url":"https://github.com/rapid7/metasploit-framework/pull/21842","tags":["exploit","Issue Tracking","Patch"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-01T03:56:08.623Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-01T03:56:08.623Z","url":"https://github.com/rapid7/metasploit-framework/pull/21842"},{"source":"nvd","sourceId":"CVE-2026-81578","modified":"2026-09-14T00:16:56.207","url":"https://github.com/rapid7/metasploit-framework/pull/21842"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578","tags":["government-resource","Patch","Third Party Advisory","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-01T03:56:08.623Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-01T03:56:08.623Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578"},{"source":"nvd","sourceId":"CVE-2026-81578","modified":"2026-09-14T00:16:56.207","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578"}]},{"source":"euvd","sourceId":"EUVD-2026-67713","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-67713","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67713","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67713"}]},{"url":"https://previdian.com/CVE-2026-81578","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://previdian.com/CVE-2026-81578"}]},{"url":"https://www.huntress.com/blog/papercut-actively-exploited","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.huntress.com/blog/papercut-actively-exploited"}]},{"url":"https://www.linkedin.com/posts/yesterday-watchtowr-rapidly-reacted-to-share-7499107361605722112-b2gE/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.linkedin.com/posts/yesterday-watchtowr-rapidly-reacted-to-share-7499107361605722112-b2gE/"}]},{"url":"https://x.com/DefusedCyber/status/2094004924660982073","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://x.com/DefusedCyber/status/2094004924660982073"}]},{"url":"https://www.acn.gov.it/portale/w/papercut-rilevato-sfruttamento-in-rete-delle-cve-2026-82078-e-cve-2026-81578","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.acn.gov.it/portale/w/papercut-rilevato-sfruttamento-in-rete-delle-cve-2026-82078-e-cve-2026-81578"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-papercut-cve-exploitation","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-papercut-cve-exploitation"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/"}]},{"url":"https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/"}]},{"url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"url":"https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578"}]},{"url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]},{"url":"https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/yora1928/PaperCut-CVE-2026-81578-82078","source":"poc-in-github","sourceId":"CVE-2026-81578","description":"Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078","modified":"2026-09-09T14:58:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-81578","url":"https://github.com/yora1928/PaperCut-CVE-2026-81578-82078"},{"source":"poc-in-github","sourceId":"CVE-2026-81578","modified":"2026-09-09T14:58:15Z","url":"https://github.com/yora1928/PaperCut-CVE-2026-81578-82078"}],"tags":[]},{"url":"https://github.com/virologi-info/papercut-toolkit","source":"poc-in-github","sourceId":"CVE-2026-81578","description":"#PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit 2 3 A **defensive** toolkit to check and understand exposure to the chained","modified":"2026-09-05T13:59:56Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-81578","url":"https://github.com/virologi-info/papercut-toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-81578","modified":"2026-09-05T13:59:56Z","url":"https://github.com/virologi-info/papercut-toolkit"}],"tags":[]}],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb","source":"metasploit","sourceId":"exploit/multi/http/papercut_ng_external_user_lookup_rce","description":"PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)","modified":"2026-09-02 10:28:21 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/multi/http/papercut_ng_external_user_lookup_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"},{"source":"metasploit","sourceId":"exploit/multi/http/papercut_ng_external_user_lookup_rce","modified":"2026-09-02 10:28:21 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"}],"tags":[]}],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-67713","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713","dateAdded":"2026-08-27","origins":[{"source":"euvd","sourceId":"EUVD-2026-67713","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-28T00:00:00Z","modified":"2026-08-28T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"PaperCut","product":"NG/MF","dueDate":"2026-09-14T00:00:00Z","cisaDateAdded":"2026-08-31T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","modified":"2026-08-28T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67713","dateAdded":"2026-08-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-67713"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://previdian.com/CVE-2026-81578"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.huntress.com/blog/papercut-actively-exploited"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.linkedin.com/posts/yesterday-watchtowr-rapidly-reacted-to-share-7499107361605722112-b2gE/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://x.com/DefusedCyber/status/2094004924660982073","dateAdded":"2026-08-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://x.com/DefusedCyber/status/2094004924660982073"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://www.acn.gov.it/portale/w/papercut-rilevato-sfruttamento-in-rete-delle-cve-2026-82078-e-cve-2026-81578","dateAdded":"2026-08-31T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.acn.gov.it/portale/w/papercut-rilevato-sfruttamento-in-rete-delle-cve-2026-82078-e-cve-2026-81578"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-papercut-cve-exploitation","dateAdded":"2026-09-04T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-papercut-cve-exploitation"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/","dateAdded":"2026-09-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578","dateAdded":"2026-09-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","dateAdded":"2026-10-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","catalog":"VulnCheck KEV","kind":"report","url":"https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce","dateAdded":"2026-10-15T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-81578","url":"https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce"}]}]}