Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.
- Chaining CVE-2026-81578 (auth bypass) with CVE-2026-82078 enables unauthenticated arbitrary Java code execution.
- Huntress observed limited real-world exploitation on two customer environments with early-stage reconnaissance behavior.
- PaperCut shipped a second emergency patch for v24, v25, and v26; new patch bypasses have since been identified.
- IoCs include 5-char .class/.cmd files, jdbc strings in server.log, SimpleHelp, and AnyDesk persistence.
- Organizations are advised to remove public exposure and apply the latest patch immediately.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.003 Windows Command ShellT1569.002 Service ExecutionT1219 Remote Access Software
- Products
- PaperCut NGPaperCut MF
- Victims
- Huntress customers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
6 min read at thehackernews.com
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.