Inside the PaperCut Zero-Day Attack Chain: Auth Bypass to Code Execution

Summary

PaperCut NG and PaperCut MF are affected by a critical zero-day vulnerability chain that allows an unauthenticated remote attacker to achieve remote code execution on the PaperCut Application Server. The attack chain involves CVE-2026-81578, an authentication bypass in the web management interface, and CVE-2026-82078, an unsafe dynamic Java class-loading vulnerability in the database connection utilities.

PaperCut confirmed active exploitation of these vulnerabilities on August 27, 2026, including incidents involving real customers. The complete pre-authentication RCE chain has also been successfully reproduced against a clean PaperCut NG installation.

CVE-2026-81578 allows an unauthenticated attacker to modify certain PaperCut system configuration parameters. This access can then be chained with CVE-2026-82078, where attacker-controlled configuration influences the Java classes loaded by PaperCut's database connection functionality. Successful exploitation can result in arbitrary Java bytecode execution under the security context of the PaperCut Application Server.

Observed attacks primarily involved system reconnaissance. Attackers executed commands such as whoami, ver, and tasklist. Investigators also found malicious Java class files and evidence of attempts to delete logs and command output to reduce forensic visibility.

Background

PaperCut NG and PaperCut MF are print management solutions used to manage printing, user authentication, print accounting, quotas, and printer services. The PaperCut Application Server provides the central application functionality and web interfaces for administration and configuration.

The security incident became public on August 27, 2026, when PaperCut published an urgent security advisory confirming that the vulnerabilities were being actively exploited, including incidents involving customers.

Security researchers investigated compromised environments and reproduced the attack chain, demonstrating that an unauthenticated remote attacker could progress from the authentication bypass to arbitrary Java code execution on a vulnerable PaperCut Application Server.

The issue is particularly significant for Internet-facing deployments. PaperCut recommends restricting Application Server access using firewalls, network access controls, VPNs, or trusted internal networks.

Vulnerability Details

CVE ID	Severity	CVSS	EPSS	Vulnerability Type
CVE-2026-81578	High	8.8	0.39%	Authentication Bypass / Missing Authentication for Critical Function
CVE-2026-82078	Critical	9.4	0.46%	Unsafe Dynamic Class Loading

CVE-2026-81578 is an improper access-control vulnerability in the PaperCut web management interface. Under specific conditions, an unauthenticated remote request can cause backend administrative actions to be executed before the access-validation process has completed. This can allow an attacker to modify certain system configuration parameters.

CVE-2026-82078 affects the PaperCut database connection utilities. The application dynamically instantiates database driver classes based on configurable driver names without adequately restricting those names to an approved allowlist. If an attacker is able to manipulate the relevant configuration parameters, the vulnerability can be abused to load attacker-controlled Java classes already available on the application's classpath.

PaperCut classifies CVE-2026-81578 as CWE-306: Missing Authentication for Critical Function and CVE-2026-82078 as CWE-470: Use of Externally-Controlled Input to Select Classes or Code.

Technical Detail

1. Authentication Bypass (CVE-2026-81578)

This vulnerability is an authorization logic flaw in the PaperCut web interface. It occurs because the server validates the permissions of the page being displayed rather than the backend action being performed. By crafting a specific request, an unauthenticated attacker can trick the server into executing administrative configuration changes without requiring a valid login.

2. Unsafe Class Loading (CVE-2026-82078)

The second flaw exists in the database connection utilities. The software allows database driver classes to be loaded dynamically based on configurable driver names. Because these names are not restricted to an approved list, an attacker who can modify the configuration can point the system toward malicious Java classes located on the application’s classpath, leading to the execution of arbitrary code.

3. The Exploitation Chain

By chaining these bugs, an attacker first uses the authentication bypass to access settings and then modifies the database driver configuration to point to a malicious payload. When the system attempts to load the "driver," it executes the attacker's Java bytecode. Testing has shown this allows for Remote Code Execution (RCE) with SYSTEM-level privileges on Windows servers.

4. Observed Activity and Impact

Security researchers have observed attackers using this chain for initial reconnaissance, running commands like whoami, ver, and tasklist to map the environment. While these initial probes are basic, the vulnerability allows for full server takeover, including the ability to deploy ransomware or steal sensitive print data.

5. Detection and Anti-Forensics

Attackers have used malicious .class files designed to delete themselves and clear the PaperCut server.log to hide their tracks. However, a primary Indicator of Compromise (IoC) remains in the database logs: the presence of the string jdbc:derby:memory:pwn, which indicates the database utility was abused to facilitate the exploit.

Affected Versions and Patch Status

PaperCut Branch	Affected Versions	Current Remediation
v26	Versions prior to 26.0.5	Emergency Patch Release 2 available
v25	Versions prior to 25.0.13	Emergency Patch Release 2 available
v24	Versions prior to 24.1.10	Emergency Patch Release 2 available
v23 and earlier	All versions	Upgrade to a current supported version

PaperCut's advisory states that the security issues affect PaperCut NG and PaperCut MF. Emergency Patch Release 2 provides mitigation for versions 24, 25, and 26. Organizations using version 23 or earlier should upgrade to a current supported version rather than waiting for an emergency patch for the older branch.

Impact

Successful exploitation can allow an unauthenticated attacker to execute arbitrary code on the PaperCut Application Server. The impact depends on the privileges of the PaperCut process and the server's network access.

1. 1. Unauthenticated remote compromise of the PaperCut Application Server.
2. 2. Unauthorized modification of PaperCut configuration.
3. 3. Arbitrary Java code execution, potentially with SYSTEM privileges on Windows.
4. 4. System reconnaissance using commands such as whoami, ver, and tasklist.
5. 5. Potential access to sensitive data and internal systems.
6. 6. Potential deletion or modification of logs and forensic artifacts.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic	Relevance
T1190	Exploit Public-Facing Application	Initial Access	Attackers exploit an Internet-accessible PaperCut Application Server to obtain initial access.
T1059.003	Windows Command Shell	Execution	The observed payload executed Windows commands through the compromised PaperCut server.
T1082	System Information Discovery	Discovery	The observed use of ver was used to identify the Windows operating-system version.
T1057	Process Discovery	Discovery	The observed use of tasklist enumerated running processes on the compromised system.
T1033	System Owner/User Discovery	Discovery	The observed whoami command identifies the user/account context of the compromised process.
T1070.004	File Deletion	Defense Evasion	The observed payload deleted temporary command output and attempted to remove PaperCut logging artifacts.

The primary ATT&CK mapping for the initial compromise is T1190 - Exploit Public-Facing Application. The discovery techniques are based on the commands actually observed by Huntress during the investigated incidents.

Mitigation

1. 1. Restrict public access. Limit PaperCut Application Server access to trusted networks, IP addresses, or VPNs.
2. 2. Apply Emergency Patch Release 2. Update PaperCut NG/MF v24, v25, and v26 to the applicable patched release.
3. 3. Check for compromise. Review logs for jdbc:derby:memory:pwn, unexpected .class files, processes, or commands such as whoami, ver, and tasklist.
4. 4. Preserve evidence. Preserve logs and relevant files before restarting or modifying a suspected compromised server.
5. 5. Review configuration. Check for unauthorized configuration changes or suspicious database connection settings.
6. 6. Investigate persistence. Check for unauthorized accounts, scheduled tasks, services, or other signs of continued attacker access.
7. 7. Perform incident response. If exploitation is suspected, investigate the system for compromise and lateral movement.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.