exploit/multi/http/papercut_ng_external_user_lookup_rce

weaponized

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

view exploit source metasploittype exploitpublished 2026-08-27catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-82078US	critical9.1OT critical	63.5% (99th)	KEV	2026-08-28
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based…
CVE-2026-81578US	critical9.8OT critical	85.6% (100th)	KEV	2026-08-28
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.