PaperCut NG/MF Zero-Days Chained for Unauthenticated RCE — Exploited Since August 26

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Backend, cloud and platform security for US and EU products

The short answer

The two vulnerabilities

PaperCut NG and PaperCut MF are enterprise-grade print and document management platforms deployed in corporate, healthcare, and education environments. Both products share the same codebase for the affected components, making neither immune to either CVE.

CVE-2026-81578 — Authentication bypass in the web management interface (CVSS 8.8)

The web management interface in PaperCut NG and MF processes administrative requests through a series of access validation checks. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before those validation checks complete. The result is that configuration values — including the database driver settings used by CVE-2026-82078 — can be written by an unauthenticated attacker. Security researchers at watchTowr, who collaborated with Huntress on the analysis, described the flaw as allowing an attacker to "edit a configuration file" via CVE-2026-81578 as a stepping stone to the more severe class-loading vulnerability.

CVE-2026-82078 — Unsafe dynamic class loading (CVSS 9.4)

PaperCut's database connection utilities load driver classes dynamically based on a configurable driver name. This driver name is read from application configuration and loaded at runtime without validation against an approved allowlist. An attacker who can write a malicious class name to the configuration — possible via CVE-2026-81578 — can cause the application to instantiate an arbitrary Java class, executing the class's static initializer or constructor. Because PaperCut runs with service-account privileges, the arbitrary code executes in that security context, with access to the local filesystem, network, and credentials stored on or accessible from the host.

How the attack chain works

The chain is two steps and requires no authentication at any point:

1. Step 1 — Bypass authentication and write configuration (CVE-2026-81578): An attacker sends a crafted HTTP request to the PaperCut web management interface targeting an administrative configuration endpoint. The access control check is bypassed, and the attacker sets the database driver name to a class of their choosing — typically a malicious class staged on an attacker-controlled server or placed on disk through another means.
2. Step 2 — Trigger class loading and execute code (CVE-2026-82078): The attacker then triggers a database connection reinitialisation — achievable through a second crafted request — causing PaperCut to load and instantiate the configured driver class. The malicious class executes on the server with PaperCut's service-account privileges.

The management interface typically listens on port 9191 (HTTP) and 9192 (HTTPS). Any internet-facing server with these ports reachable, or any environment where an attacker already has internal network access, is directly exploitable without further prerequisites. Our penetration testing work consistently finds that administrative interfaces like this are reachable far more broadly than organizations expect — either because firewall rules were temporarily opened and never closed, or because internal network segmentation is shallower than assumed.

Active exploitation timeline

Huntress researchers identified exploitation evidence in PaperCut server logs dated August 26, 2026 — one full day before PaperCut published its advisory on August 27. The log entries showed base64-encoded reconnaissance commands being executed through the vulnerability chain, consistent with an attacker performing initial environment enumeration after obtaining code execution.

PaperCut confirmed customer incidents and released its first emergency patch on August 28 for versions 24, 25, and 26. Later that day, a second emergency patch release was issued after watchTowr and Huntress identified bypasses of the first set of patches. Organizations should verify they are running the second August 28 emergency release, not the first, and should check for any additional updates published after August 28 before assuming they are protected.

The pre-advisory exploitation window indicates that the vulnerability was known to attackers before the patch was available. Any internet-facing PaperCut server that was reachable on August 26 or 27 should be treated as potentially compromised, not merely at risk, until a forensic review of server logs confirms otherwise.

Who is affected

PaperCut NG and PaperCut MF are deployed across a wide range of industries. The software has over 100 million users across more than 100 countries, with concentration in higher education, healthcare, financial services, and large enterprise environments. Both products are affected; all versions are currently considered potentially vulnerable until patched with the August 28 emergency releases.

Organizations with cloud-hosted or SaaS PaperCut deployments should check with their hosting provider whether patches have been applied on their behalf. Unlike some enterprise SaaS platforms, PaperCut's SaaS offering does not uniformly auto-patch — the update model depends on the hosting arrangement. Self-hosted deployments (on-premises or customer-managed cloud VMs) require manual action.

What it means for US & EU software teams

PaperCut is a third-party software component in most enterprise environments — not custom-built software, but a vendor product managed by IT operations. For teams that build and integrate enterprise software, this incident illustrates a consistent pattern: enterprise software environments carry a long tail of administrative interfaces that are not regularly reviewed for security posture, not monitored for unusual access patterns, and not included in standard penetration test scope.

The authentication bypass in CVE-2026-81578 targets one of the most common failure modes in enterprise web applications: access control checks applied after, rather than before, backend actions are initiated. This pattern is frequently found in older enterprise software where administrative endpoints were designed for internal-only use and never hardened against external exposure. When the same interfaces are then reachable from corporate networks that lack effective internal segmentation — or when they are inadvertently internet-exposed — the security assumption built into the original design collapses entirely.

For EU enterprises, healthcare and financial services organizations running PaperCut should assess whether the servers process personal data — likely yes, given that print job records contain at minimum user identifiers and document metadata. A successful exploit of CVE-2026-82078 on a server processing personal data constitutes a personal data breach under GDPR Article 4(12), regardless of whether data was actually exfiltrated. The 72-hour notification obligation under Article 33 applies from the point the controller becomes aware, which for organizations that ran unpatched internet-facing PaperCut on August 26 and 27 may have already elapsed. For NIS2-scoped entities in the EU, the same logic applies: an unpatched critical-severity flaw under active exploitation is difficult to characterize as proportionate security under Article 21.

For US enterprises in healthcare or finance, HIPAA and PCI DSS both impose equivalent obligations. HIPAA requires covered entities and business associates to review and patch vulnerabilities in systems that store or process PHI; PCI DSS Requirement 6 mandates that security patches be applied within one month of release for systems in the cardholder data environment. Emergency patches released August 28 start both clocks for any organization that runs PaperCut in a regulated environment.

What to do now

1. Identify all PaperCut NG and MF instances in your environment. This includes on-premises servers, cloud-hosted instances, and any instances run by managed service providers on your behalf. Shadow IT discovery tools and network scans for ports 9191/9192 can help surface untracked instances.
2. Immediately restrict network access to the management interface. PaperCut recommends restricting the Application Server to trusted IP addresses only. Apply network-level ACLs blocking external and untrusted internal access to ports 9191 and 9192 before patching if patching cannot happen within hours. This eliminates the remote attack surface while the patch process is arranged.
3. Apply the August 28 emergency patches — specifically the second release. Patches are available for PaperCut NG and MF versions 24, 25, and 26 via the PaperCut Knowledge Base and the vendor's emergency security advisory. Verify that you are applying the second August 28 release, which addressed bypasses of the first. Check the PaperCut security advisory page for any patches released after August 28 before assuming your version is protected.
4. Review server logs for exploitation indicators from August 26 onward. Huntress identified exploitation via base64-encoded commands in PaperCut server logs. Review the application logs, web server access logs, and any available endpoint detection output for the period from August 26 onward. Specific indicators of compromise published by Huntress and watchTowr can be used to query logs for known attack patterns.
5. Treat servers exposed on August 26 or 27 as potentially compromised. Apply the patch, then assess whether the server was internet-reachable or reachable from attacker-controlled internal segments on August 26 or 27. If yes, treat it as a potential incident: review for persistence mechanisms (new scheduled tasks, new service accounts, new files in the application directory), changed configuration values, and unusual outbound network connections from the server.
6. Open compliance workflows in parallel. For GDPR-scoped organizations, begin a preliminary incident assessment now to determine whether personal data stored in or accessible from PaperCut was potentially exposed. For HIPAA or PCI DSS environments, initiate the relevant breach assessment procedures. Do not wait for forensic confirmation of data exfiltration to start these processes — the obligation begins at the point the breach becomes known, not when it is fully characterized.

Frequently asked questions

Sources

BleepingComputer — PaperCut releases second emergency patch for exploited flaws, August 28, 2026
Help Net Security — PaperCut NG/MF vulnerabilities exploited in zero-day attacks, August 27, 2026
The Hacker News — Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication, August 2026
Rapid7 — PaperCut NG/MF Critical Zero-Day Exploited in the Wild, August 2026