PaperCut NG/MF Auth Bypass to RCE (CVE-2026-81578 / CVE-2026-82078)

Summary

PaperCut NG and PaperCut MF print-management servers are under active attack through two chained flaws: CVE-2026-81578 (missing authentication for a critical function / unauthenticated configuration write on the web admin surface) and CVE-2026-82078 (unsafe reflection / dynamic class loading in database-connection utilities). Together they yield pre-authentication remote code execution on the host running the PaperCut service.

PaperCut warned customers on 2026-08-27 after a university DFIR team supplied enough detail to reproduce the issue. Huntress reports exploitation attempts as early as 2026-08-26. A first emergency patch shipped the same week and was bypassed; Emergency Patch Release 2 followed on 2026-08-28. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on 2026-08-31, with a 2026-09-14 BOD 26-04 remediation date for federal civilian agencies.

Post-exploit activity moved quickly from scanning to data theft (Defused honeypots: Derby table dumps via hijacked user-lookup) and, per watchTowr and PaperCut IoCs, to hands-on-keyboard and remote-access tooling. Shadowserver has counted 1,000+ internet-exposed NG/MF instances. Education-sector credential theft has been reported in follow-on coverage.

OFFSITE.DARK indexes vendor, CISA, and defender reporting. We do not reproduce the chain.

Key Findings

Chain (conceptual)

Unauthenticated request to PaperCut web admin
        ↓
CVE-2026-81578 — privileged component runs without a login
        ↓
Attacker rewrites external DB / user-lookup configuration
        ↓
CVE-2026-82078 — driver name from config is loaded without an allowlist
        ↓
Code execution in the PaperCut Java process

Public defender write-ups (Rapid7, Huntress, watchTowr) describe the second stage as JDBC driver instantiation plus abuse of bundled database engines. Operators should patch and hunt; they should not treat those write-ups as a lab recipe.

Versions and patching

Affected: PaperCut NG/MF version trains 24, 25, and 26 on Windows, Linux, and macOS (vendor emergency branches). Applying only the first emergency patch is not sufficient. Operators must land Emergency Patch Release 2 (coverage cites 24.1.10+ as a target line — confirm against PaperCut’s current advisory for your train).

PaperCut is working on a full official release that includes both fixes; until that ships, the emergency package is the close-out.

Impact

• Full compromise of the print-management host — historically a path into AD because PaperCut often holds directory bind credentials and sits on school/enterprise networks with broad reach.
• 2023-era PaperCut exploitation (Clop / LockBit / state actors) is the precedent; this wave already shows data-theft and RAT follow-on, not just probes.
• Internet-exposed admin interfaces turn a local print server into a pre-auth RCE on the public internet.

Mitigation

1. Apply Emergency Patch Release 2 immediately; do not stop at the 2026-08-27 package.
2. Remove PaperCut admin interfaces from the open internet; restrict to management networks / VPN.
3. Hunt PaperCut IoCs from the vendor advisory; watchTowr/Huntress notes include unexpected local accounts (coverage has cited Administrator17 — verify against current IoC lists).
4. If compromise is possible: rotate AD binds, printer-admin credentials, and any secrets on the host; assume Derby/user tables were readable.
5. Federal civilian agencies: KEV due 2026-09-14 under BOD 26-04, plus pre-patch compromise checks.

Related Signals

• SonicWall SMA1000 SSRF/RCE
• StyleSmuggler Magento RCE
• JFrog Artifactory auth bypass
• CISA KEV September 2026 cluster

Sources

• CISA — two KEV additions (PaperCut)
• Rapid7 — PaperCut NG/MF zero-day exploited in the wild
• BleepingComputer — patched PaperCut zero-days used in data theft
• SecurityWeek — exploitation escalates to active intrusions