Attackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.
- Two chained zero-days: CVE-2026-81578 (access control) and CVE-2026-82078 (class loading)
- Attackers install SimpleHelp and AnyDesk as redundant remote access channels
- Second emergency patch round extends fixes to the v24 branch; v23 and older still unpatched
- Huntress confirmed exploitation in two customer environments; watchTowr found patch bypasses
- Vendor recommends restricting web access, applying patches, and rebuilding compromised Application Servers
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1087 Account DiscoveryT1018 Remote System DiscoveryT1105 Ingress Tool TransferT1219 Remote Access Software
- Organizations
- Defused
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
4 min read at helpnetsecurity.com
The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most recent update on the ongoing attack campaign.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.