Affected Systems

PaperCut NG and PaperCut MF (all unpatched versions). CVE-2026-81578 (CVSS 8.8, improper access control) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) are chained to bypass authentication and execute arbitrary Java code. Second emergency patch released; additional patch bypasses identified affecting fully patched versions.

Exploitation Status

Active exploitation confirmed. Huntress observed limited attacks on two customer environments. Attackers executing reconnaissance commands (whoami, ver, tasklist) and deploying cross-platform Java .class files for fingerprinting and log cleanup. Threat actor motivation and scale unknown. Multiple patch bypasses discovered by watchTowr; some bypasses affect the latest patched version.

Business Impact

Unauthenticated remote code execution on internet-facing PaperCut servers grants attackers full control over print management infrastructure. High risk for lateral movement into corporate networks and exfiltration of sensitive printed documents. Observed post-exploitation includes system fingerprinting and log deletion to evade detection. Organizations with public-facing PaperCut instances face immediate compromise risk. Patch bypasses mean even updated systems may remain vulnerable.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately remove public internet exposure for all PaperCut NG and MF Application Servers; place behind VPN or restrict to trusted IP addresses only.
  • Apply the second emergency patch from PaperCut immediately; monitor vendor advisories for additional patches addressing newly identified bypasses.
  • Hunt for indicators of compromise: search PaperCut logs for 'Database error looking up cardID: VALUES CAST' errors, check for Udydn.out files in /data/content/, review server.log and derby.log for tampering or deletion.
  • Audit PaperCut server.log and application logs for Base64-encoded commands, unexpected Java .class file execution, or reconnaissance commands (whoami, ver, tasklist) executed around August 27-28, 2026.
  • Inventory all PaperCut instances in the environment, verify patch status, and implement network segmentation to isolate print infrastructure from critical systems.