PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
PaperCut NG and PaperCut MF are affected by two vulnerabilities that can be chained to achieve unauthenticated remote code execution on the PaperCut Application Server. CVE-2026-81578, an improper access control vulnerability with a CVSS 4.0 score of 8.8 (High), allows unauthenticated remote requests to trigger certain administrative backend actions before access validation is completed, enabling an attacker to modify system configuration. CVE-2026-82078, an unsafe dynamic class loading vulnerability with a CVSS 4.0 score of 9.4 (Critical), can allow arbitrary Java bytecode execution when an attacker can manipulate the affected configuration parameters. Chained together, the vulnerabilities can result in pre-authentication remote code execution under the security context of the PaperCut server process. PaperCut has confirmed active exploitation and customer incidents.
Technical Details
CVE-2026-81578 is an improper access control vulnerability in the PaperCut NG/MF web management interface. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks are completed. This allows an unauthenticated remote attacker to modify certain system configuration settings. PaperCut classifies the issue as CWE-306, Missing Authentication for Critical Function, and assigns it a CVSS 4.0 score of 8.8 (High).
CVE-2026-82078 is an unsafe dynamic class loading vulnerability in PaperCut NG/MF database connection utilities. The application instantiates database driver classes based on configurable driver names without validating those names against an approved allowlist. If an attacker can manipulate the relevant system configuration, the vulnerability can enable execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. PaperCut classifies the issue as CWE-470, Use of Externally-Controlled Input to Select Classes or Code, and assigns it a CVSS 4.0 score of 9.4 (Critical).
The vulnerabilities can be chained because CVE-2026-81578 provides the unauthenticated ability to alter configuration that CVE-2026-82078 can then use to load attacker-controlled Java code. Researchers have reproduced the full pre-authentication remote code execution chain against PaperCut NG, and PaperCut has confirmed exploitation in customer environments.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform — Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability chain can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from the NodeZero platform to determine whether the PaperCut vulnerability chain can be exploited
- Patch immediately: Apply PaperCut Emergency Patch Release 2 or implement the vendor-recommended mitigation
- Re-run the test: Confirm the vulnerability chain is no longer exploitable after remediation
Indicators of Compromise
PaperCut has published indicators associated with exploitation of these vulnerabilities and subsequent attacker activity. The absence of these indicators does not confirm that a system has not been compromised.
| Indicator Type | Description |
| Process | Suspicious post-exploitation activity involving pc-app.exe or pc-app, particularly child shell processes such as cmd.exe |
| Log File | Missing, unexpectedly truncated, or deleted PaperCut server.log files |
| Log Entry | ERROR No suitable driver found for jdbc:no:x |
| Log Entry | ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST |
| Log Entry | DB URL: jdbc:derby:memory:pwn;create=true |
| Log Entry | Database error looking up cardID: VALUES CAST(X'cafebabe |
| Log Entry | DB URL: jdbc:no:x DB Driver: <5-char random name> |
| File | <install>\server\lib\<5-char-name>.class |
| File | <install>\server\data\content\<5-char-name>.cmd |
| File | <install>\server\data\content\<5-char-name>.out |
| Command | Observed discovery activity including whoami & ver, tasklist, nltest /dclist:, and quser |
| Service | Unexpected Windows service named Remote Access Service running SimpleService.exe |
| Application | Unexpected AnyDesk installation associated with post-compromise activity |
PaperCut notes that attackers may clean up files and logs during exploitation, so the absence of these artifacts does not rule out compromise.
Affected versions & patch
Affected
PaperCut states that the advisory applies to all versions of PaperCut NG and PaperCut MF.
Fixed
PaperCut has released Emergency Patch Release 2 for:
- PaperCut NG/MF v24
- PaperCut NG/MF v25
- PaperCut NG/MF v26
PaperCut recommends installing Release 2 even if the original emergency patch was already applied because Release 2 includes additional hardening. PaperCut also states that the emergency patch has not gone through its normal release process and is not an official product release.
Customers running PaperCut NG/MF v23 or earlier should upgrade to the latest supported version. Site Servers and secondary/print servers should also be updated to a patched version. PaperCut states that Print Deploy and Mobility Print are not affected by these vulnerabilities.
Mitigations
If the PaperCut NG/MF Application Server is accessible from the public internet, PaperCut recommends immediately restricting web access to trusted IP addresses only. Organizations should use firewall rules, network access controls, or equivalent measures to ensure PaperCut server web interfaces cannot be reached from untrusted internet addresses.
If compromise is suspected, PaperCut recommends preserving current backups, completely wiping and rebuilding the Application Server, restoring from a clean backup taken before suspicious activity, and activating the organization’s incident-response procedures.
Timeline
- August 26, 2026: Huntress observed exploitation activity in PaperCut customer environments during its investigation of the vulnerability chain.
- August 27, 2026: PaperCut published its initial urgent security bulletin and confirmed active exploitation and customer incidents affecting PaperCut NG and PaperCut MF.
- August 28, 2026: PaperCut published its initial emergency patch for PaperCut NG/MF v25 and v26.
- August 28, 2026: CVE-2026-81578 and CVE-2026-82078 were publicly disclosed for the two vulnerabilities.
- August 28, 2026: PaperCut published Emergency Patch Release 2 for v25 and v26 with additional hardening, followed by Release 2 for v24.
- August 28, 2026: Horizon3 started assessment and alerted affected customers.
- August 30, 2026: PaperCut added additional indicators of compromise and post-compromise investigation guidance to its advisory.
- August 31, 2026: Horizon3 released a NodeZero Rapid Response test for CVE-2026-81578 and CVE-2026-82078.
