CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.
- CVE-2026-81578 lets unauthenticated requests alter configuration; CVE-2026-82078 allows attacker-selected Java class loading.
- Chain results in pre-auth RCE under the PaperCut server process security context.
- Emergency Patch Release 2 covers NG/MF v24, v25, and v26; all versions are affected and v23 or older requires upgrade.
- IOCs include 'ERROR No suitable driver found for jdbc:no:x' log entries, a Remote Access Service running SimpleService.exe, and AnyDesk installs.
- Mitigation: restrict PaperCut web interfaces to trusted IPs; Print Deploy and Mobility Print are not affected.
- Products
- PaperCut NGPaperCut MF
- Organizations
- Horizon3.aiHuntressPaperCut
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
4 min read at horizon3.ai
CVE-2026-81578 and CVE-2026-82078 can be chained to achieve unauthenticated remote code execution in PaperCut NG/MF. NodeZero® Rapid Response safely validates whether the attack chain is exploitable.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.