PaperCut Software Hit by Urgent Exploits Leveraging Newly Disclosed Critical Vulnerabilities
Malicious actors are actively exploiting recently patched security flaws in PaperCut NG and MF to execute unauthorized code on susceptible instances. The software company has responded with a fresh emergency fix that includes additional security hardening to counter the evolving threats.
The vulnerability allows unauthenticated attackers to gain remote control over the application’s trusted configuration, ultimately enabling them to execute arbitrary Java code within the application’s process. The technical flaw resides in how the software handles specific requests. By sending a specially crafted request, an attacker can reference one page to be rendered for the response while simultaneously triggering an action on a different page. Because the authorization checks trust the rendered page, they fail to verify the permissions required by the hidden component behind it. This allows an unauthenticated individual to alter the server configuration, unlocking access to sensitive endpoints that trigger unsafe actions and culminating in the execution of attacker-controlled code.
The company publicly disclosed two critical vulnerabilities associated with this exploit chain. The first, CVE-2026-82078, carries a CVSS score of 9.4 and is an unsafe dynamic class loading vulnerability located in the database connection utilities. In affected versions, the application instantiates database driver classes based on configurable driver names without validating those names against an allowlist of approved drivers. The second, CVE-2026-81578, holds a CVSS score of 8.8 and is an improper access control vulnerability within the web management interface. Under certain conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks are completed.
Threat actors are chaining these two vulnerabilities together to bypass authentication and achieve remote code execution. By exploiting the access control flaw, attackers can bypass login requirements and edit a configuration file, which in turn triggers the unsafe dynamic class loading flaw to run arbitrary code on the server.
Security monitoring teams have observed limited exploitation on two customer environments. In these incidents, attackers executed Base64-encoded commands on the targeted servers as part of their post-exploitation activity, running chained commands like “whoami” and “ver” to identify user accounts and operating systems. Additionally, attackers deployed a Java .class file that operates independently of the underlying operating system, allowing it to run commands on both Linux and Windows systems. This malicious file fingerprints the machine, obtains a directory listing of files, and writes the data to a specific output file. Once the information is gathered, the program deletes the output file along with the server’s main log file and an internal database log to cover the attackers’ tracks. In a more recent incident recorded on August 27th, a modified version of the malicious file was used to also capture a list of all running processes on the system.
The situation remains fluid, as the vendor released a second emergency patch for versions 24, 25, and 26, claiming it includes “additional hardening beyond the original emergency patch.” While analyzing these updated patches reveals security improvements that address parts of the previously observed attack chain, cybersecurity researchers have already identified new bypasses affecting the fully patched version. The ultimate end goal of the threat actors remains unclear, but current activity appears consistent with early-stage reconnaissance and validation.
**FAQ**
**Q: Which systems are affected by these vulnerabilities?**
A: PaperCut NG and PaperCut MF are the affected software products.
**Q: What is the most severe risk posed by these vulnerabilities?**
A: The most severe risk is Remote Code Execution (RCE). By chaining the two flaws, an attacker can bypass authentication and run arbitrary code with the privileges of the application’s process.
**Q: How do attackers chain the vulnerabilities to gain access?**
A: Attackers first use the improper access control vulnerability (CVE-2026-81578) to bypass authentication and modify a configuration file. This modification then triggers the unsafe dynamic class loading vulnerability (CVE-2026-82078), which allows them to execute their malicious Java code on the server.
**Q: What indicators of compromise should organizations look for?**
A: Organizations should monitor for the deletion of log files such as “server.log” and “derby.log,” the presence of output files like “Udydn.out” in data directories, and specific database error messages in log files that indicate unauthorized access attempts.
**Q: Has the second emergency patch completely resolved the issue?**
A: While the second emergency patch remediates parts of the previously observed attack chain, new patch bypasses and an additional authentication bypass vulnerability have been identified affecting the latest fully patched version.
**Conclusion**
The active exploitation of these critical vulnerabilities in PaperCut NG and MF underscores the severe risks posed by internet-facing print management systems. Because these platforms can serve as a pivot point into corporate networks and hold sensitive document data, immediate action is essential. Organizations must remove public internet exposure, apply the latest emergency patches without delay, and restrict web access to the application server through trusted IP addresses or VPNs. Continuous monitoring for signs of compromise is also critical to detect and mitigate any lingering threats.
Thank you for reading
