PaperCut Flaws Chained for Unauthenticated
Attackers are exploiting two critical PaperCut vulnerabilities, CVE-2026-82078 and CVE-2026-81578, to achieve unauthenticated remote code execution.
Malicious actors are chaining two critical vulnerabilities in PaperCut NG and MF to execute arbitrary code without authentication. The Australian software company has issued a second emergency patch in response, according to a report from The Hacker News.
Huntress researchers John Hammond and Andrew Brandt stated the flaw gives an unauthenticated attacker remote control over PaperCut's trusted configuration. This control could be used to execute arbitrary Java code inside the application's process.
Critical Vulnerabilities Detailed
The two publicly disclosed flaws carry high severity ratings. The preemptive exposure management firm watchTowr reports that attackers are chaining these vulnerabilities together to bypass authentication and gain remote code execution on affected instances.
| CVE Identifier | CVSS Score | Description |
|---|---|---|
| CVE-2026-82078 | 9.4 | An unsafe dynamic class loading vulnerability in the database connection utilities. The application instantiates database driver classes based on configurable driver names without validating against an allowlist. |
| CVE-2026-81578 | 8.8 | An improper access control vulnerability in the web management interface. Under specific conditions, unauthenticated remote requests can trigger backend actions before access validation checks are complete. |
PaperCut's second emergency patch includes what the company calls "additional hardening beyond the original emergency patch." The company has not yet shared details about the nature of the malicious activity weaponizing the flaws.
Observed Exploitation Activity
Huntress said it has observed limited exploitation in two customer environments. Attackers executed Base64-encoded commands on targeted servers as part of post-exploitation activity. These commands were used to determine user account and operating system information using a chained command: "whoami & ver".
Also deployed is a Java .class file that is operating system agnostic. It can run commands on either Linux or Windows systems to fingerprint the machine and obtain a directory listing. The data is written to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory. This file, along with the server's "server.log" and a "/data/internal/derby.log" file, is deleted after the step is complete.
In another incident recorded on August 27, 2026, threat actors used a different version of the .class file. This version ran a tweaked command to also capture the list of running processes: "whoami & ver & tasklist".
Mitigation and Hunting Advice
Organizations with PaperCut NG and MF in their environment are advised to remove public exposure immediately and apply the patch. It is also recommended to restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path.
Jake Knott, head of threat intelligence at watchTowr, warned that PaperCut is a prime target. He stated it is not only an internet-facing pivot into a corporate environment but also a sensitive information treasure trove if printed documents can be stored and exfiltrated. Knott advised organizations with vulnerable internet-facing instances to remove public internet access where possible and hunt for signs of compromise. One indicator is looking for 'Database error looking up cardID: VALUES CAST' errors in log files.
The cybersecurity firm watchTowr also discovered multiple patch bypasses and an additional authentication bypass vulnerability. These are likely to have been addressed as part of the second emergency patch.
