PaperCut Faces Active Exploitation of Zero-Day Vulnerability in Print Management Software
PaperCut is urging customers to apply an emergency patch or take servers offline following active exploitation of a zero-day vulnerability in its NG and MF print management products.
PaperCut, a widely used provider of print management software, is currently responding to a critical zero-day vulnerability that is being actively exploited in the wild. The flaw affects both PaperCut NG and PaperCut MF products, which are designed to manage access to printers, track usage, and facilitate printing from various devices within an organization.
The vulnerability came to light after a university's security team reported an attack targeting their PaperCut deployment. Following this report, PaperCut's security team investigated and confirmed the existence of the flaw, subsequently issuing an urgent security advisory. While the advisory itself does not detail the specific nature of the vulnerability, indicators of compromise suggest that the issue involves the software's web interface, potentially allowing attackers to gain deeper access into customer networks.
Evidence of exploitation includes alterations to log files and alerts generated by various security tools, such as intrusion detection systems, endpoint security solutions, and network monitoring packages. This suggests that attackers are leveraging the vulnerability to establish a foothold and potentially move laterally within compromised environments. The exact attack vector and the full extent of the potential network access remain under investigation.
In response to the active exploitation, PaperCut has developed and released an emergency patch. However, the company notes that this patch has not undergone its standard release process due to the urgency of the situation. This means customers applying the patch should do so with caution, understanding it is an interim solution.
PaperCut's advisory strongly recommends that customers take immediate action to mitigate the risk. The primary recommendation is to restrict access to the PaperCut web interface, allowing connections only from trusted internal IP addresses. For organizations unable to implement these network restrictions or those with public-facing PaperCut servers, taking the affected servers offline entirely is advised as a more secure, albeit disruptive, temporary measure.
The company is working diligently to develop a more robust and officially released fix for the vulnerability. Further updates will be provided to customers as soon as a stable, validated patch is ready for deployment. Until then, customers are advised to prioritize the immediate application of the emergency patch or the isolation of their PaperCut servers.
This incident highlights the persistent threat posed by zero-day vulnerabilities, especially those affecting software with broad network access capabilities like print management systems. The rapid exploitation underscores the importance of timely vendor responses and proactive customer security measures, including network segmentation and strict access controls for exposed services.
The latest advisory from PaperCut details specific indicators of compromise, including suspicious post-exploitation activity from "pc-app.exe" and the presence of specific error messages in server logs related to database connections. Additionally, it highlights the potential for missing or truncated log files as a sign of compromise, providing actionable intelligence for incident response teams.
The Rapid7 blog post provides significant technical depth into the PaperCut NG/MF zero-day vulnerability, detailing the authentication bypass mechanism via crafted SQL injection through the web interface. It explains how attackers can leverage Apache Tapestry's request handling to invoke administrative components and reconfigure external database lookups to achieve remote code execution, even detailing specific URIs and configuration parameters used in attacks. The article also highlights the potential use of the bundled Apache Derby and H2 databases, along with Nashorn JavaScript engine, to execute arbitrary commands.
The Record article provides specific CVE identifiers, CVE-2026-82078 and CVE-2026-81578, for the vulnerabilities affecting PaperCut NG and MF, noting that both carry severity scores over 8.8. It also details that an initial patch was insufficient and a subsequent, more effective patch was developed in collaboration with Huntress and watchTowr.
This new report details how attackers are chaining two specific vulnerabilities, CVE-2026-82078 and CVE-2026-81578, to achieve unauthenticated remote code execution. The exploitation involves bypassing authentication via the web management interface and then leveraging an unsafe dynamic class loading flaw in the database connection utilities to execute arbitrary Java code. Researchers have observed limited exploitation, with attackers performing reconnaissance by executing commands to identify user accounts and operating systems.
The latest details reveal that attackers are chaining two zero-day vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and execute arbitrary Java bytecode. Post-compromise activity includes enumerating domain controllers, downloading a 'sendit.sh' payload to install SimpleHelp remote access software, and establishing a secondary AnyDesk channel. Researchers have also identified potential patch bypasses and an additional authentication vulnerability.
PaperCut has released a second set of emergency patches, "Emergency Patch Release 2," which it advises all customers to install, even if they previously applied the initial patch. This updated release includes additional hardening measures and better protects customers who cannot make their PaperCut software public-facing, incorporating insights gained from researchers at Huntress and watchTowr. The company also provided indicators of compromise to help organizations hunt for signs of breach.
CISA has officially added two PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that evidence of active exploitation for both the missing authentication flaw and the unsafe reflection issue has been confirmed. Federal agencies are now mandated to prioritize patching these vulnerabilities on public-facing assets as per Binding Operational Directive 26-04.
CISA has officially added CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the active exploitation of these PaperCut flaws. This inclusion mandates that federal agencies patch these vulnerabilities by September 14th, as threat actors are now engaging in hands-on-keyboard activity post-compromise, moving beyond simple reconnaissance.
New analysis reveals that attackers are actively exploiting two specific PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, to target educational institutions in the U.S. and Europe. The exploitation chain facilitates credential theft, command execution, and the creation of privileged accounts, with observed post-exploitation activity including the deployment of credential harvesting tools like lsa_collect.exe and Meterpreter payloads.
The latest reporting confirms that the exploitation of PaperCut vulnerabilities CVE-2026-81578 and CVE-2026-82078 began on August 27, 2026, and that these flaws were subsequently added to CISA's Known Exploited Vulnerabilities (KEV) catalog by August 31. Beyond initial access, attackers are actively using these flaws to steal credentials, establish privileged accounts like 'Administrator17', and exfiltrate sensitive data from configuration files using commands like findstr.