PaperCut NG/MF Zero-Day Under Active Exploitation Across All Versions

Summary

PaperCut has confirmed active zero-day exploitation of two now-published flaws affecting all versions of PaperCut NG and PaperCut MF. CVE-2026-82078 (Unsafe Dynamic Class Loading, CWE-470; CVSS 9.4) executes arbitrary code on the server but requires control of configuration parameters, while CVE-2026-81578 (Authentication Bypass, CWE-306; CVSS 8.8) supplies exactly that, letting an unauthenticated attacker alter configuration. Chained, CVE-2026-81578 for entry and CVE-2026-82078 for code execution, they may yield unauthenticated remote code execution (RCE) against internet-exposed PaperCut Application Servers.

PaperCut’s initial emergency patches (Release 1 and Release 2) were subsequently shown to be bypassable, and the vendor has since published Emergency Patch Release 3, cumulative of all emergency releases, which supersedes the earlier patches. It must be applied across v24/v25/v26, including Site Servers and secondary/print servers, even where an earlier patch was already installed; alongside patching, PaperCut urges restricting the web interface to trusted IPs. Given PaperCut’s history as a recurring initial-access target, any exposed or unpatched PaperCut server should be treated as at risk and, if internet-exposed at any point during this window, as potentially already compromised.

Vulnerability Details

Finding #1

PaperCut Software has confirmed that attackers are actively exploiting two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, in its PaperCut NG and PaperCut MF print management software, and is treating the incident as its highest priority. Both vulnerabilities affect all versions of both products, making the version number irrelevant to exposure. PaperCut’s security team reproduced the vulnerabilities using information provided by a university user’s internal security and digital forensics team, which is also how it confirmed they were being actively exploited in the wild, establishing this as a zero-day at the point of disclosure.

Finding #2

The exploitation path is a two-vulnerability chain. CVE-2026-81578 (Authentication Bypass, CWE-306; CVSS 8.8) lets an unauthenticated attacker trigger administrative backend actions before access-validation completes and modify system configuration, while CVE-2026-82078 (Unsafe Dynamic Class Loading, CWE-470; CVSS 9.4) executes arbitrary Java bytecode on the server but requires the configuration control that CVE-2026-81578 provides. Chained, they yield an unauthenticated remote code execution path, as reproduced by external researchers. Researchers subsequently reported multiple bypasses of the initial emergency patch and an additional authentication bypass beyond CVE-2026-81578, indicating the exploitable surface is broader than the two originally disclosed CVEs.

Finding #3

The indicators shared so far are behavioral and log-based rather than atomic artifacts. Defenders should watch suspicious activity from the legitimate pc-app.exe process, and server.log files that are modified, deleted, or missing, plus two error strings referencing a JDBC driver failure and a cardID lookup error. The JDBC driver-failure string aligns with CVE-2026-82078’s database-connector class-loading path, tying that indicator to the code-execution stage of the chain. The log tampering suggests anti-forensic activity, and the vendor warns their absence does not rule out compromise.

Finding #4

PaperCut released an initial emergency patch for v25 and v26 on August 28, 2026, then Emergency Patch Release 2 later that day, extending coverage to v24. After both were found to be bypassable, PaperCut published Emergency Patch Release 3 on September 1, 2026, cumulative of all emergency releases, which supersedes the earlier patches. It must be installed across v24/v25/v26, including Site Servers and secondary/print servers, not only the primary Application Server, even where an earlier patch was already applied.

Vulnerability & CPE Reference

Recommendations

MITRE ATT&CK TTPs

Indicators of Compromise (IoCs)

References & Patch Links

• https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
• https://www.huntress.com/blog/papercut-actively-exploited