PaperCut Second Emergency Patch: CVE-2026-82078 and CVE-2026-81578 Exploit Chain In the Wild
PaperCut issued a second emergency update fixing two chainable high-severity flaws in NG/MF print management software. Unauthenticated RCE is possible. Vendor confirmed in-the-wild exploitation.
PaperCut flaws escalate again: the vendor shipped a second emergency security update for two chainable high-severity vulnerabilities in NG and MF print management software. Combined, an authentication bypass plus arbitrary Java bytecode execution yields unauthenticated remote code execution on the server. The vendor confirmed in-the-wild exploitation and customer security incidents.
Incident Overview
PaperCut NG/MF is widely deployed in enterprises, universities, and government agencies. Typical installs sit on the internal network and integrate deeply with Active Directory. This round covers two CVEs:
- CVE-2026-82078 (CVSS 9.4): unsafe class loading. After specific configuration manipulation, an attacker can execute arbitrary Java bytecode;
- CVE-2026-81578 (CVSS 8.8): authentication bypass. Allows unauthenticated configuration changes and paves the rest of the chain.
Key risk: researchers found multiple bypasses of the first-round patches. Organizations that applied only the initial fix and have not deployed the second round (Patch Release 2, versions 24–26) remain exposed.
Technical Details
Chained, the two bugs form a full unauthenticated RCE path: CVE-2026-81578 bypasses authentication and mutates application config; CVE-2026-82078 then loads and executes arbitrary Java bytecode on top of that change. PaperCut application servers often sit deep in the network, talk directly to AD domain controllers, and handle sensitive print jobs. Compromise yields a stable foothold for internal lateral movement.
The vendor published IOCs. Hunt for:
- Suspicious JDBC connection strings;
- Unexpected `.class`, `.cmd`, `.out` files under the application directory;
- `pc-app` spawning shell child processes;
- Post-exploitation deployment of remote-access tools such as SimpleHelp or AnyDesk.
Impact Assessment
The chain needs no credentials and no user interaction. Exploit complexity is low. The vendor confirmed in-the-wild use and real customer incidents. Universities, enterprises, healthcare, and government are primary targets. Treat hosts missing the second-round patch as incident-response priority, not a routine patch cycle.
Remediation
- Upgrade PaperCut NG/MF immediately to a build that includes the second emergency fix;
- Check whether instances are internet-exposed; restrict the application-server web UI to trusted internal IP ranges;
- Hunt JDBC strings, anomalous files, and suspicious processes against vendor IOCs;
- If patching cannot happen immediately, take the PaperCut server offline until the fix is applied.
References
- Enigma Global Daily Threat Intelligence Digest (2026-08-31)
- Zinbiel Daily Security Brief (2026-08-31)