CISA adds two PaperCut NG/MF flaws to exploited list
The agency also cited federal vulnerability-remediation guidance in Binding Operational Directive 26-04.
CISA said on Aug. 31 that it added two PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.
In an alert, the agency said exploited vulnerabilities are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise.
The alert references Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk. CISA said the directive sets vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the role of the KEV Catalog in federal patching decisions.
According to the notice, BOD 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the catalog on publicly exposed assets that would grant total control of the asset after exploitation. It also allows lower-risk vulnerabilities to be deferred. The directive also sets expectations for when agencies must check whether threat actors compromised a system before patching it.
The source material provided with the alert does not name the two vulnerabilities in the main text, but the candidate metadata identifies them as CVE-2026-81578 and CVE-2026-82078. The metadata describes CVE-2026-81578 as a PaperCut NG/MF missing authentication for critical function vulnerability and CVE-2026-82078 as a PaperCut NG/MF unsafe reflection vulnerability.
CISA said BOD 26-04 applies only to FCEB agencies, but it encourages all organizations to use risk-based vulnerability management and to prioritize remediation of KEV Catalog entries. The agency also said it will keep adding vulnerabilities that meet its criteria and will consider nominations that include a CVE ID, evidence of exploitation and clear mitigation guidance.
CISA’s notice points agencies and other operators to the KEV list as the main reference for remediation priorities.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()