As reported by SecurityAffairs, PaperCut confirmed on August 27 that a pre-authentication remote code execution chain is being actively exploited against real-world customers, with Huntress researchers reproducing the full attack against a clean PaperCut NG 25.0.11.75758 installation. The fact that 47% of tracked installations remain unpatched transforms this from a standard patch-priority exercise into an active incident response scenario for any organization running the software.

Security Impact: As reported by SecurityAffairs, PaperCut confirmed on August 27 that a pre-authentication remote code execution chain is being actively exploited against real-world customers, with Huntress researchers reproducing the full attack against a clean PaperCut NG 25.0.11.75758 installation.

Vulnerability Summary

CVETypeSeverityAffected ProductExploited
CVE-2026-81578Authorization bypass — permission check on displayed page rather than executed actionCritical (pre-auth)PaperCut NG / PaperCut MF (unpatched versions)Yes — confirmed in the wild
CVE-2026-82078Unsafe Java class loading via database utilitiesCritical (RCE)PaperCut NG / PaperCut MF (unpatched versions)Yes — chained with CVE-2026-81578

The chain is straightforward and devastating: CVE-2026-81578 lets an unauthenticated attacker bypass authorization by exploiting a page-versus-action mismatch in PaperCut's permission model. The server validates permissions for the page it renders, not the action it executes. That access opens the door to CVE-2026-82078, which abuses database utilities to load attacker-supplied Java classes — yielding arbitrary code execution as the PaperCut service account.

Why the Reconnaissance Phase Matters Most

The observed intrusions described by Huntress are currently limited to reconnaissance commands — whoami, ver, tasklist — with no secondary malware, C2 traffic, or persistence yet observed. Defenders should not interpret this as low impact. This pattern is the canonical first stage of a manual intrusion where an operator validates access, enumerates the environment, and assesses whether the target warrants deeper engagement.

The two-minute intrusions with trivial commands are not failed attacks — they are successful probes. The next wave will likely include credential dumping, lateral movement, and ransomware deployment.

The forensic artifacts are equally telling. Attackers dropped a malicious Java class directly into PaperCut's installation directory, executed commands, wrote output to a temporary file, and then deleted both the output and the server's log file. This is deliberate anti-forensics — not the behavior of opportunistic script kiddies. The surviving Derby database artifact is a gift for incident responders and should be prioritized as a detection anchor.

Who Is Most Exposed

Why the Reconnaissance Phase Matters Most
Education sector: Schools are heavy PaperCut users and often have slow patch cycles due to academic calendars and limited IT staff.
Healthcare: Hospitals running PaperCut for print management face both operational disruption and HIPAA breach notification obligations if exploitation is confirmed.
Exposed internet-facing installations: Any PaperCut server reachable from the internet is at critical risk. Print management servers should never be internet-exposed, but misconfigurations persist.
Default or weak service account configurations: If PaperCut runs as SYSTEM or a high-privilege account, the RCE chain grants near-total host compromise.

Immediate Actions

  1. Patch immediately. Apply the latest PaperCut release to all PaperCut NG and PaperCut MF installations. Prioritize internet-facing servers first, then internal servers.
  2. Restrict network exposure. Move PaperCut administration interfaces behind VPN or restrict to management subnets. The application server port should never be reachable from the public internet.
  3. Hunt for artifacts. Search PaperCut installation directories for unexpected .class files. Check for missing or truncated server log files. Query Derby database files for anomalous entries.
  4. Review service account privileges. Ensure PaperCut runs under a least-privilege service account — never LocalSystem.
  5. Enable and centralize logging. Forward PaperCut application logs, Windows Event Logs, and file integrity monitoring alerts to your SIEM for the installation directory.

Shield53 Recommendations

Treat this as an active incident, not a patching backlog item. The 47% unpatched figure means threat actors have a large target pool and will likely automate exploitation soon. Organizations should:

  • Conduct emergency asset discovery to identify all PaperCut deployments, including forgotten instances on print servers and departmental machines.
  • Deploy file integrity monitoring on the PaperCut installation directory with alerts for any new .class or .jar files.
  • Create SIEM detection rules for the reconnaissance commands observed (whoami, ver, tasklist) originating from the PaperCut service process.
  • If patching cannot be completed within 24-48 hours, disable external access to the PaperCut web interface as an interim mitigation.
  • Engage incident response if any indicators are found — the reconnaissance phase means you may have a narrow window before escalation.

The broader lesson is familiar but unlearned: print management software is critical infrastructure that receives inadequate security attention. PaperCut runs on domain-joined servers in environments with sensitive data, yet it is rarely included in vulnerability scanning programs or hardening baselines. This attack chain should be the catalyst to change that.