CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.
- CVE-2026-81578 lets unauthenticated requests alter configuration; CVE-2026-82078 allows attacker-selected Java class loading.
- Chain results in pre-auth RCE under the PaperCut server process security context.
- Emergency Patch Release 2 covers NG/MF v24, v25, and v26; all versions are affected and v23 or older requires upgrade.
- IOCs include 'ERROR No suitable driver found for jdbc:no:x' log entries, a Remote Access Service running SimpleService.exe, and AnyDesk installs.
- Mitigation: restrict PaperCut web interfaces to trusted IPs; Print Deploy and Mobility Print are not affected.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 2% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |
Full article958 words · extracted from horizon3.ai · click to collapse
PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
PaperCut NG and PaperCut MF are affected by two vulnerabilities that can be chained to achieve unauthenticated remote code execution on the PaperCut Application Server. CVE-2026-81578, an improper access control vulnerability with a CVSS 4.0 score of 8.8 (High), allows unauthenticated remote requests to trigger certain administrative backend actions before access validation is completed, enabling an attacker to modify system configuration. CVE-2026-82078, an unsafe dynamic class loading vulnerability with a CVSS 4.0 score of 9.4 (Critical), can allow arbitrary Java bytecode execution when an attacker can manipulate the affected configuration parameters. Chained together, the vulnerabilities can result in pre-authentication remote code execution under the security context of the PaperCut server process. PaperCut has confirmed active exploitation and customer incidents.
Technical Details
CVE-2026-81578 is an improper access control vulnerability in the PaperCut NG/MF web management interface. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks are completed. This allows an unauthenticated remote attacker to modify certain system configuration settings. PaperCut classifies the issue as CWE-306, Missing Authentication for Critical Function, and assigns it a CVSS 4.0 score of 8.8 (High).
CVE-2026-82078 is an unsafe dynamic class loading vulnerability in PaperCut NG/MF database connection utilities. The application instantiates database driver classes based on configurable driver names without validating those names against an approved allowlist. If an attacker can manipulate the relevant system configuration, the vulnerability can enable execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. PaperCut classifies the issue as CWE-470, Use of Externally-Controlled Input to Select Classes or Code, and assigns it a CVSS 4.0 score of 9.4 (Critical).
The vulnerabilities can be chained because CVE-2026-81578 provides the unauthenticated ability to alter configuration that CVE-2026-82078 can then use to load attacker-controlled Java code. Researchers have reproduced the full pre-authentication remote code execution chain against PaperCut NG, and PaperCut has confirmed exploitation in customer environments.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform — Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability chain can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
Run the Rapid Response test: Launch from the NodeZero platform to determine whether the PaperCut vulnerability chain can be exploited
Patch immediately: Apply PaperCut Emergency Patch Release 2 or implement the vendor-recommended mitigation
Re-run the test: Confirm the vulnerability chain is no longer exploitable after remediation
Indicators of Compromise
PaperCut has published indicators associated with exploitation of these vulnerabilities and subsequent attacker activity. The absence of these indicators does not confirm that a system has not been compromised.
Indicator Type Description
Process Suspicious post-exploitation activity involving pc-app.exe or pc-app , particularly child shell processes such as cmd.exe
Log File Missing, unexpectedly truncated, or deleted PaperCut server.log files
Log Entry ERROR No suitable driver found for jdbc:no:x
Log Entry ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
Log Entry DB URL: jdbc:derby:memory:pwn;create=true
Log Entry Database error looking up cardID: VALUES CAST(X'cafebabe
Log Entry DB URL: jdbc:no:x DB Driver: <5-char random name>
File <install>\server\lib\<5-char-name>.class
File <install>\server\data\content\<5-char-name>.cmd
File <install>\server\data\content\<5-char-name>.out
Command Observed discovery activity including whoami & ver, tasklist, nltest /dclist: , and quser
Service Unexpected Windows service named Remote Access Service running SimpleService.exe
Application Unexpected AnyDesk installation associated with post-compromise activity
PaperCut notes that attackers may clean up files and logs during exploitation, so the absence of these artifacts does not rule out compromise.
Affected versions & patch
Affected
PaperCut states that the advisory applies to all versions of PaperCut NG and PaperCut MF.
Fixed
PaperCut has released Emergency Patch Release 2 for:
PaperCut NG/MF v24
PaperCut NG/MF v25
PaperCut NG/MF v26
PaperCut recommends installing Release 2 even if the original emergency patch was already applied because Release 2 includes additional hardening. PaperCut also states that the emergency patch has not gone through its normal release process and is not an official product release.
Customers running PaperCut NG/MF v23 or earlier should upgrade to the latest supported version. Site Servers and secondary/print servers should also be updated to a patched version. PaperCut states that Print Deploy and Mobility Print are not affected by these vulnerabilities.
Mitigations
If the PaperCut NG/MF Application Server is accessible from the public internet, PaperCut recommends immediately restricting web access to trusted IP addresses only. Organizations should use firewall rules, network access controls, or equivalent measures to ensure PaperCut server web interfaces cannot be reached from untrusted internet addresses.
If compromise is suspected, PaperCut recommends preserving current backups, completely wiping and rebuilding the Application Server, restoring from a clean backup taken before suspicious activity, and activating the organization’s incident-response procedures.
Timeline
August 26, 2026: Huntress observed exploitation activity in PaperCut customer environments during its investigation of the vulnerability chain.
August 27, 2026: PaperCut published its initial urgent security bulletin and confirmed active exploitation and customer incidents affecting PaperCut NG and PaperCut MF.
August 28, 2026: PaperCut published its initial emergency patch for PaperCut NG/MF v25 and v26.
August 28, 2026: CVE-2026-81578 and CVE-2026-82078 were publicly disclosed for the two vulnerabilities.
August 28, 2026: PaperCut published Emergency Patch Release 2 for v25 and v26 with additional hardening, followed by Release 2 for v24.
August 28, 2026: Horizon3 started assessment and alerted affected customers.
August 30, 2026: PaperCut added additional indicators of compromise and post-compromise investigation guidance to its advisory.
August 31, 2026: Horizon3 released a NodeZero Rapid Response test for CVE-2026-81578 and CVE-2026-82078.
References
PaperCut Urgent Security Advisory
PaperCut Security Vulnerability Log
CVE.org Record – CVE-2026-81578
CVE.org Record – CVE-2026-82078
NIST NVD – CVE-2026-81578
NIST NVD – CVE-2026-82078
Huntress: PaperCut Zero-Day – Active Exploitation and Pre-Auth RCE
Text extracted automatically; images, tables and formatting may be missing. Original: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-81578-cve-2026-82078/