CISA added PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078 to KEV on August 31, 2026. Here is who is affected, how the chain works, and what small businesses should do before the September 14 due date.