ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “PaperCut NG”

15 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 20Vulnerability 8Ransomware 6Threat actor 3Research 1Tools 1
SeverityAllcritical 19high 17medium 1low 0info 2

PaperCut NG/MF vulnerabilities exploited in zero-day attacks

PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.

PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.

Help Net Security · 16d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078CVE-2023-27350+1 CVEs1

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker News · 14d agoExploit / PoC in the wildCVE-2026-82078CVE-2026-815781

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.

PaperCut alerted customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and MF print management software, with confirmed customer incidents and an ongoing investigation. Emergency patches were released for v25 and v26, and the flaw was later identified as an exploitation chain of CVE-2026-81578 and CVE-2026-82078 enabling remote code execution. Shared IoCs include suspicious post-exploitation activity from pc-app.exe and missing, truncated or deleted server.log files with specific database errors. Users with internet-exposed PaperCut Application Servers are urged to immediately restrict access to trusted IPs; in 2023, CVE-2023-27350 (CVSS 9.8) in the same products was exploited by Lace Tempest to deliver Cl0p and LockBit ransomware.

The Hacker News · 16d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078CVE-2023-273501

Attackers plant remote access tools on compromised PaperCut servers

Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.

An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.

Help Net Security · 14d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

PaperCut warns of hackers using printer management software flaw in attacks

PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.

PaperCut issued an emergency advisory saying vulnerabilities in PaperCut NG and MF, tracked as CVE-2026-82078 and CVE-2026-81578 with severity scores above 8.8, are under active exploitation with confirmed customer incidents. Huntress reported at least two customers impacted, and an initial patch was revised with input from Huntress and watchTowr researchers. PaperCut software is widely deployed at universities, corporations, and governments managing printers from Canon, Epson, Xerox, and Brother, and the vendor urged removing server web interfaces from the public internet. Previous PaperCut flaws were used by ransomware gangs like Bl00dy and Clop, and CISA has warned the education sector is particularly exposed.

The Record · 19d agoExploit / PoC in the wildCVE-2026-82078CVE-2026-81578

PaperCut Zero-Day Under Active Attack: Emergency Patch Released

PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.

PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.

Security Affairs · 18d agoExploit / PoC in the wildCVE-2023-27350CVE-2023-273511

PaperCut security advisory (AV26-858) – Update 2

CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.

Canada's Cyber Centre updated security advisory AV26-858, noting PaperCut MF and PaperCut NG versions prior to the v24, v25, and v26 Emergency Patch Release 2 are affected by CVE-2026-81578 and CVE-2026-82078. Open-source reporting indicates both vulnerabilities are being exploited in the wild. In Update 2 (August 31, 2026), CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and the Cyber Centre urges administrators to apply the emergency patches immediately.

Canadian Centre for Cyber Security · 16d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078

Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch

PaperCut pre-auth RCE CVE-2026-81578 actively exploited; 47% of tracked installs unpatched and exposed to remote code execution.

Huntress confirmed active exploitation of a pre-authentication RCE flaw in PaperCut (CVE-2026-81578), chainable with CVE-2026-82078 to achieve SYSTEM-level code execution via PaperCut's Application Server. Observed attacks focused on short reconnaissance (whoami, ver, tasklist) with no persistence, but a malicious Java class dropping into the installation directory leaves the jdbc:derby:memory:pwn breadcrumb. Roughly 47% of ~2,500 tracked installations run version 23 or earlier with no patch yet available.

Security Affairs · 10d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.

CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.

Security Affairs · 15d agoVulnerability in the wildCVE-2026-81578CVE-2026-82078

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise · 7d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

AI-powered attack exploited PaperCut flaws to hack 395 organizations

AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.

GreyNoise reports a likely Russian-speaking threat actor used hundreds of AI agents combining OpenAI Codex and DeepSeek models to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, launching the campaign on August 31. At least 440 PaperCut instances at 395 organizations across 48 countries were compromised, with the education sector accounting for roughly half of victims and the US most targeted. Attackers harvested credentials from 280 victims, obtained OS or domain secrets from 147, and gained admin privileges at 12 organizations, using LSASS dumping, pass-the-hash, noPac, and DCSync to dump NTDS.DIT. The adversary went from empty workspace to first RCE in under four hours, and compromised at least 11 organizations within 26 seconds once the campaign launched.

BleepingComputerupdated · 5d agofirst · 6d agoExploit / PoC in the wild 7 sourcesCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1· 1 read