As reported by BleepingComputer, PaperCut has issued a second emergency patch for its NG and MF print management software after researchers at watchTowr and Huntress discovered that the initial fix could be circumvented. The underlying vulnerabilities — CVE-2026-81578 and CVE-2026-82078 — are being actively exploited in the wild and can be chained to achieve unauthenticated remote code execution. This is not a routine patch cycle; it is a case study in why emergency fixes that address symptoms rather than root causes often extend the attack window rather than close it.
Vulnerability Summary
| CVE | Severity | CVSS | Description |
|---|---|---|---|
| CVE-2026-81578 | High | 8.8 | Authentication bypass in PaperCut NG/MF web management interface — unauthenticated requests can trigger admin backend actions before access validation completes |
| CVE-2026-82078 | Critical | 9.4 | Unsafe dynamic class-loading in database connection utilities — attacker-controlled driver names load arbitrary Java bytecode from the classpath without an allowlist, enabling RCE |
Affected products: PaperCut NG and PaperCut MF, versions 25 and 26.
Active exploitation: Yes, confirmed zero-day attacks prior to disclosure.
Patch status: Emergency Patch Release 2 now available — supersedes Release 1, which was bypassable.
Why This Matters Beyond the Headline
The most significant takeaway is not the existence of two critical flaws in a widely deployed print management platform — though that alone is serious. The real story is the patch-bypass cycle. PaperCut released an initial emergency fix, presumably under time pressure, and researchers subsequently found multiple ways around it. This forced a second release with additional hardening. Any organization that applied Release 1 and considered itself protected was operating under a false sense of security during the gap between the two patches.
Emergency patches that seal one entry point while leaving adjacent attack paths open do not reduce risk — they redistribute it. Defenders who treat the first fix as final become the next wave of victims.
The vulnerability chain itself follows a familiar and dangerous pattern: an authentication bypass (CVE-2026-81578) grants access to administrative functions, which in turn enables manipulation of configuration parameters that feed into the unsafe class-loading mechanism (CVE-2026-82078). The class-loading flaw — loading database driver classes based on user-controllable names without an allowlist — is a textbook Java deserialization-adjacent weakness. It reflects a design assumption that configuration values would always be trusted, an assumption that collapses the moment authentication is bypassed.
Who Is Most Exposed
- Education sector: PaperCut has deep penetration in K-12 and higher education, where print management servers are frequently internet-exposed and IT teams are resource-constrained.
- Large enterprises with distributed print fleets: PaperCut MF deployments in multi-site organizations often have management interfaces accessible beyond segmented internal networks.
- Organizations that applied only Release 1: These environments remain vulnerable to the bypass techniques identified by watchTowr and must upgrade to Release 2 immediately.
- Cloud-hosted PaperCut instances: Exposed management interfaces on cloud platforms present the highest-value targets for chaining both CVEs into unauthenticated RCE.
Immediate Actions
Shield53 Recommendations
Organizations should treat this incident as a reminder that print management infrastructure — often overlooked in security programs — is a high-value target with deep system access. PaperCut servers run as privileged services, manage network-connected devices, and frequently hold service accounts with broad directory access. A compromise here is not a contained event; it is a foothold.
- Inventory and exposure reduction: Map all PaperCut deployments across the environment. Any management interface reachable from the internet should be rearchitected behind VPN or zero-trust network access. No print management console needs public exposure.
- Adopt a "patch-plus-verify" protocol: When emergency patches are released for actively exploited flaws, do not treat installation as closure. Assign a security engineer to validate the fix against the described attack vector and monitor researcher disclosures for bypass reports in the 72 hours following release.
- Segment print infrastructure: Place PaperCut servers on isolated network segments with strict egress filtering. The service account running PaperCut should have least-privilege directory permissions — not domain admin, as is alarmingly common.
- Build detection content now: Create SIEM rules for authentication anomalies on PaperCut web interfaces, configuration file modifications, and unexpected child processes spawned by the PaperCut Java service. This detection logic should persist beyond the current patch cycle.
- Engage with coordinated disclosure timelines critically: PaperCut's initial withholding of CVE details was defensible, but the bypass discovery shows that even patched systems were at risk. Maintain internal threat intel feeds monitoring researcher publications during active exploitation windows.
The broader industry lesson is clear: when a vendor releases an emergency patch for an actively exploited critical vulnerability, defenders should assume the fix is incomplete until independent researchers validate it. The window between Release 1 and Release 2 is exactly when attackers escalate — because defenders believe the door is closed.
