Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
PaperCut pre-auth RCE CVE-2026-81578 actively exploited; 47% of tracked installs unpatched and exposed to remote code execution.
Huntress confirmed active exploitation of a pre-authentication RCE flaw in PaperCut (CVE-2026-81578), chainable with CVE-2026-82078 to achieve SYSTEM-level code execution via PaperCut's Application Server. Observed attacks focused on short reconnaissance (whoami, ver, tasklist) with no persistence, but a malicious Java class dropping into the installation directory leaves the jdbc:derby:memory:pwn breadcrumb. Roughly 47% of ~2,500 tracked installations run version 23 or earlier with no patch yet available.
- Pre-auth RCE chain (CVE-2026-81578 + CVE-2026-82078) reproduced by Huntress against PaperCut NG 25.0.11.75758
- 47% of ~2,500 tracked PaperCut installs still run version 23 or earlier, with no fix yet for those versions
- Derby log entry jdbc:derby:memory:pwn is a high-confidence indicator of compromise
- Defenders advised to remove PaperCut Application Server from the public internet until patched
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1082 System Information DiscoveryT1057 Process DiscoveryT1059.007 JavaScript/JScript
- Organizations
- Huntress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.