CISA adds two PaperCut NG/MF flaws to exploited list

By Atlas Watchline Staff · Regulatory · August 31, 2026

CISA said it added two PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

CISA said on Aug. 31 that it added two PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

In an alert, the agency said exploited vulnerabilities are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise.

The alert references Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk. CISA said the directive sets vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the role of the KEV Catalog in federal patching decisions.

According to the notice, BOD 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the catalog on publicly exposed assets that would grant total control of the asset after exploitation. It also allows lower-risk vulnerabilities to be deferred. The directive also sets expectations for when agencies must check whether threat actors compromised a system before patching it.

The source material provided with the alert does not name the two vulnerabilities in the main text, but the candidate metadata identifies them as CVE-2026-81578 and CVE-2026-82078. The metadata describes CVE-2026-81578 as a PaperCut NG/MF missing authentication for critical function vulnerability and CVE-2026-82078 as a PaperCut NG/MF unsafe reflection vulnerability.

CISA said BOD 26-04 applies only to FCEB agencies, but it encourages all organizations to use risk-based vulnerability management and to prioritize remediation of KEV Catalog entries. The agency also said it will keep adding vulnerabilities that meet its criteria and will consider nominations that include a CVE ID, evidence of exploitation and clear mitigation guidance.

CISA’s notice points agencies and other operators to the KEV list as the main reference for remediation priorities.

Sources

• CISA alert page
• CISA Cybersecurity Advisories RSS

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.