Skip to content

PaperCut NG/MF zero-day: active exploitation of unauthenticated admin-trigger chain (CVE-2026-81578 / CVE-2026-82078)

Summary

PaperCut's August 27–28, 2026 urgent security bulletin (updated through August 28, 10:08pm AEST) confirms active exploitation of a vulnerability chain affecting all versions of PaperCut NG and PaperCut MF, with confirmed customer incidents. Two CVEs are now public:

  • CVE-2026-81578 — Authentication Bypass (CWE-306, missing authentication for critical function) in the web management interface: unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes, letting an unauthenticated remote attacker modify certain system configurations. PaperCut rates it 8.8 High: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N.
  • CVE-2026-82078 — Unsafe Dynamic Class Loading in Database Connector (CWE-470, unsafe reflection): the database-connection utilities instantiate driver classes from a configurable driver name with no allowlist validation; if an attacker can manipulate system configuration parameters (reachable via the auth bypass), this executes arbitrary Java bytecode from the application classpath under the PaperCut server process. PaperCut rates it 9.4 Critical: CVSS:4.0/AV:N/AC:L/AT:N:PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.

PaperCut's emergency patch Release 2 (published August 28, 8:42pm AEST; a v24 build followed at 10:08pm AEST) fixes both CVEs and adds hardening developed with Huntress and watchTowr. PaperCut advises installing Release 2 even if the original emergency patch (v25/v26, published August 28, 2:10am AEST) was already applied.

Tags

Why this matters

  • PaperCut NG/MF Application Servers are extremely common in on-prem print management (education, government, enterprise) and are frequently internet-exposed or reachable through VPN/forwarding.
  • The exploitation chain combines an unauthenticated configuration-modification primitive (CVE-2026-81578) with a privileged-input unsafe class-loading bug (CVE-2026-82078, PR:H): unauthenticated admin-function trigger → system-configuration manipulation → unsafe class loading → arbitrary code execution as the PaperCut server process (typically a privileged Windows service account).
  • This is the second major PaperCut exploitation wave in the public record: in 2023, CVE-2023-27350 (CVSS 9.8) was exploited by Russian threat actors and the financially motivated group Lace Tempest to deliver Cl0p and LockBit ransomware.
  • No public actor attribution yet; PaperCut is "investigating active exploitation" with confirmed customer incidents and says a university customer's security/DFIR team helped reproduce the vulnerability. Huntress observed limited exploitation in two customer environments (early-stage recon: whoami & ver / whoami & ver & tasklist, an OS-agnostic Java .class fingerprinter writing to Udydn.out, and deletion of server.log / derby.log); watchTowr confirmed the full unauthenticated chain and disclosed new patch bypasses against the latest patched build.

Reported timeline (PaperCut bulletin updates)

  • Aug 27, 2026 (AEST): initial security bulletin published; minor wording updates at 8:00pm; investigation update at 9:02pm.
  • Aug 28, 2:10am: emergency patch published for v25 and v26.
  • Aug 28, 10:43am: guidance for customers using external-database Card/ID number lookups.
  • Aug 28, 8:42pm: Emergency Patch Release 2 published for v25/v26 with additional hardening (with Huntress and watchTowr); security.properties guidance added.
  • Aug 28, 10:08pm: Release 2 published for v24.

Confirmed exploitation mechanics (Huntress + watchTowr)

Huntress (John Hammond, Andrew Brandt) and watchTowr (Jake Knott) confirmed the full unauthenticated chain and observed limited real-world exploitation:

  • watchTowr chain (unauthenticated → RCE): a crafted request can refer to one page that is rendered for the response and a different page that owns the component/action being executed. PaperCut's authorization check trusts the rendered page and misses the permissions required by the component behind it. An unauthenticated request uses this to modify the server configuration (CVE-2026-81578), which then unlocks sensitive endpoints that trigger unsafe actions, ultimately executing arbitrary attacker-controlled code (via CVE-2026-82078). "CVE-2026-81578 allows you to bypass authentication, and from there you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution" — watchTowr.
  • Huntress framing: "This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process." Huntress observed limited exploitation in two customer environments, with attackers executing Base64-encoded recon commands to identify the victim user account and OS (a chained whoami & ver), plus a deployed OS-agnostic Java .class file that fingerprints the machine and lists files, writes output to Udydn.out under a /data/content/ path, then deletes Udydn.out, server.log, and /data/internal/derby.log. A second incident (Aug 27) used a tweaked .class running whoami & ver & tasklist to also capture running processes.
  • Assessment of end goal (Huntress): "we don't have enough evidence to determine the threat actors' ultimate end goal … the activity appears consistent with early-stage reconnaissance or validation, including commands to identify the victim's user account and operating system."
  • Patch-bypass warning (watchTowr): multiple patch bypasses and an additional authentication-bypass vulnerability were discovered; one bypass is fixed in the second emergency patch (Release 2), but new patch bypasses affecting the latest fully-patched version have been identified. This elevates urgency toward the hardening controls (restrict web access to trusted IPs / VPN, security.properties tuning) rather than patch-only.

Indicators of compromise (PaperCut-published + Huntress-observed)

  • Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe.
  • Missing, unexpectedly truncated, or deleted server.log files.
  • The following entries in server.log:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

PaperCut explicitly warns that absence of these indicators is not confirmation of non-compromise; validated, specific IOCs are still pending.

Mitigation and response

  1. Immediately restrict access to the PaperCut web interfaces to trusted/internal IP addresses if the server is public-internet-reachable — PaperCut says to do this now even without observed suspicious activity.
  2. Install Emergency Patch Release 2 (v24/v25/v26) via the standard upgrade procedure, in place of the original emergency patch. Pre-v24 installs: upgrade to a current version.
  3. Update Site Servers and secondary/print servers too, not just the primary Application Server. Print Deploy and Mobility Print are not affected.
  4. External-database Card/ID lookup customers: add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server (feature defaults to off; without the key, external lookups are silently ignored even if the Admin UI shows the feature configured).
  5. Assume compromise on any internet-exposed instance until proven otherwise: hunt for pc-app.exe post-exploitation activity, log-tampering (truncated/deleted server.log), the two error signatures above, new scheduled tasks/service accounts, and lateral movement from the print server. Preserve evidence before cleanup.

Assessment limits

  • The two CVEs were made public by PaperCut's security team on August 28, 2026; as of this page's last update neither had appeared in NVD.
  • No public attribution to a named actor; PaperCut's investigation is ongoing. Huntress's observed activity is limited to two customer environments and assessed as early-stage recon/validation.
  • Patch bypasses remain open: watchTowr identified new bypasses against the latest fully-patched build (one earlier bypass fixed in Release 2), so patch-alone is not a guaranteed control — pair with access restriction and security.properties hardening.
  • Severity scores are PaperCut's own (they are the CVE Numbering Authority for their products).
  • The emergency patch is not an official release (PaperCut FAQ) — treat the download channel and hashes accordingly.

Sources