PaperCut Patches Actively Exploited PaperCut NG/MF Zero-Day Chain

PaperCut NG and MF are print management platforms widely used across offices, schools, and universities to control print jobs, card access, and multi-function copier fleets. On August 27, 2026, PaperCut's security response team published an urgent advisory saying it was investigating active exploitation of a then-unnamed vulnerability and had already confirmed customer incidents, according to Rapid7's analysis.

A day later the vendor assigned CVE-2026-81578, an authentication bypass rated CVSSv4 8.8, and CVE-2026-82078, an unsafe dynamic class-loading flaw in the database connector rated CVSSv4 9.4. Chained together, the two let an unauthenticated attacker reach remote code execution on the PaperCut Application Server, the single component that Help Net Security describes as the "brain" of each PaperCut NG or MF deployment.

Per Rapid7's technical writeup, the flaw abuses PaperCut's use of the Apache Tapestry framework, whose "complex direct" request format lets a URL name one page to display and a different page's component to actually execute. PaperCut validates access only against the displayed page, so an attacker can pick the public Error, Exception, or Home page for display while invoking privileged ConfigEditor or UserList components underneath.

Using unauthenticated POST requests such as /app?service=direct/1/Error/ConfigEditor/$Form, an attacker rewrites PaperCut's external user-lookup settings to point at an attacker-controlled JDBC connection. By chaining PaperCut's bundled Apache Derby driver, an H2 JDBC URL, and an inline INIT statement, the attacker creates a JavaScript-backed database trigger that PaperCut's embedded Nashorn engine can use to launch an operating-system process, completing the RCE chain when a forged UserList search triggers the lookup.

• PaperCut currently treats all versions of PaperCut NG and MF as potentially impacted, not just versions 24 through 26 that received patches so far.
• ShadowServer Foundation data cited by SecurityWeek counted roughly 1,000 PaperCut instances directly exposed to the internet, with a majority located in North America and Europe.
• Huntress researchers John Hammond and Andrew Brandt reported limited exploitation on two customer environments, with post-exploitation commands (whoami and ver) used to fingerprint the compromised host.
• Huntress separately reproduced a full pre-authentication remote code execution chain against a stock install of PaperCut NG 25.0.11.75758, the prior public release.

PaperCut has released two rounds of emergency patches. The first, issued August 27, 2026 for versions 25 and 26 and extended to version 24 on August 28, could still be bypassed using the Home page request path. A second Release 2 patch published later on August 28 closes that gap, and PaperCut is telling every customer to install it even if they already applied the original emergency fix.

• Apply the Release 2 emergency patch for PaperCut NG/MF versions 24, 25 or 26 without waiting for the next scheduled release cycle.
• Restrict Application Server web access to trusted internal IP ranges using firewall rules, network access controls, or reverse-proxy restrictions.
• Take the access-restriction step immediately even if no suspicious activity has been observed, per PaperCut's own advisory.
• Disconnect internet-facing Application Servers from the public internet where restricting to trusted IPs is not immediately feasible.

PaperCut has not yet published network indicators such as malicious IP addresses or domains, and it explicitly warns that their absence does not mean a system is clean. The indicators shared so far focus on host and log artifacts rather than network traffic.

• Endpoint or network-monitoring alerts tied to the PaperCut Application Server, especially post-exploitation activity from a file named pc-app.exe.
• Missing, unexpectedly truncated, or deleted PaperCut server.log files, which can indicate attackers covering their tracks.
• The server.log entries "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST".

This is not PaperCut's first brush with mass exploitation. CISA's Known Exploited Vulnerabilities catalog already lists three PaperCut NG/MF flaws, and two of them were used in ransomware attacks, per SecurityWeek. In 2023, CVE-2023-27350, an improper access control bug in the SetupCompleted class, was exploited by Iran-linked groups and by the Clop/LockBit-affiliated actor Lace Tempest to deliver ransomware payloads, according to Security Affairs.

That history is why Rapid7 frames the new chain as urgent even before ransomware activity is confirmed: internet-facing print servers are an established entry point for this vendor's customer base, and the current advisory has not yet been added to the CISA KEV catalog. PaperCut's investigation into the new attacks remains ongoing, and the identity of the actors behind the campaign is unknown.

Unauthenticated attackers can chain the two flaws to reach remote code execution on internet-facing PaperCut Application Servers, and PaperCut has confirmed active exploitation against customers, including a university whose incident response team helped the vendor reproduce the bug.

Security: A first emergency patch was itself bypassable via the Home page request path, so organizations that applied only the original fix remain exposed until they install PaperCut's Release 2 patch.

PaperCut confirmed active exploitation of an authentication-bypass and RCE chain in NG/MF, now tracked as CVE-2026-81578 and CVE-2026-82078, and shipped two rounds of emergency patches within 24 hours.