Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr details a PaperCut pre-auth RCE chain exploited in the wild and repeated patch bypasses.
On 27 August 2026, PaperCut warned that version 26.0.3 was being exploited in the wild and initially published IOCs without a patch. watchTowr reproduced the chain as CVE-2026-81578, an authentication bypass, plus CVE-2026-82078, a post-auth RCE, then found patch bypasses tracked as WT-2026-0141 through WT-2026-0143. A new post-auth RCE, CVE-2026-82077, was fixed in 26.0.5 on 10 September 2026 after earlier 26.0.4 and 26.0.4-PO builds. PaperCut is widely used in schools, healthcare, and government and was previously exploited via CVE-2023-27350 and CVE-2023-27351.
- Version 26.0.3 was exploited in the wild before PaperCut shipped a patch.
- In-the-wild chain is CVE-2026-81578 auth bypass plus CVE-2026-82078 RCE.
- watchTowr bypassed 26.0.4 fixes and reported WT-2026-0141 through WT-2026-0143.
- New post-auth RCE CVE-2026-82077 was fixed in PaperCut 26.0.5.
- Vendors
- PaperCut
- Products
- PaperCut NG
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2023-27351 | Authentication Bypass in PaperCut NG/MF Print Management Software | 7.5 | 78% | KEVRansomware | KEV |
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
| CVE-2026-82077 | Path Traversal RCE in PaperCut NG and PaperCut MF Fax Component | 7.3 | — |
From the original article
12 min read at labs.watchtowr.com
Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper!
By Piotr Bazydlo (@chudyPB) · labs.watchtowr.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.