ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “PaperCut MF”

8 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 18Vulnerability 7Ransomware 6Threat actor 3Research 1Tools 1
SeverityAllcritical 19high 14medium 1low 0info 2

CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities

Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.

PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.

Horizon3.ai · 15d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

PaperCut confirms active exploitation of critical zero-days CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF print management software, with confirmed customer incidents.

PaperCut Software issued an urgent advisory on August 27, 2026, confirming it is investigating active exploitation of flaws in PaperCut NG and PaperCut MF and treating the issue as a security emergency. On August 28 the vendor assigned CVE-2026-81578 and CVE-2026-82078 to the two vulnerabilities forming the exploit chain. At initial disclosure, no CVSS score, vulnerability class, authentication requirements, or exploit path details were public. Rapid7 is tracking the issue as an emerging threat.

Rapid7 Blog · 19d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078

PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE-2026-82078 & CVE-2026-81578)

PaperCut NG/MF zero-days CVE-2026-82078 and CVE-2026-81578 are actively exploited, chaining to pre-auth RCE on the Application Server.

PaperCut issued an urgent security advisory for two actively exploited vulnerabilities, CVE-2026-82078 and CVE-2026-81578, affecting all versions of PaperCut NG and PaperCut MF. When chained, the flaws enable pre-authentication remote code execution on the PaperCut Application Server, originating from a request-confusion and authorization gap. PaperCut is widely deployed for print management in enterprises and education, making unpatched instances a high-value target.

Qualys ThreatPROTECT · 16d agoExploit / PoC in the wildCVE-2026-82078CVE-2026-81578

PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

PaperCut NG/MF hit by a pre-auth RCE zero-day under active exploitation; Huntress reproduced the chain and urged immediate patching.

Huntress reports active exploitation of a zero-day in PaperCut NG and PaperCut MF, and says it reproduced a pre-authentication remote code execution chain. The flaw allows unauthenticated attackers to execute code on exposed PaperCut servers. Huntress published urgent patching, exposure-reduction, and detection guidance. No CVE identifier was provided in the announcement.

Huntress · 19d agoExploit / PoC in the wild