PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078: Chained Pre-Auth RCE, Three Emergency Patches, CISA KEV

Introduction

On August 27 PaperCut published an urgent bulletin: attackers were already exploiting PaperCut NG/MF Application Servers. Two bugs chain into pre-authentication remote code execution. CVE-2026-81578 (CVSS 8.8) is an authentication bypass on the web management interface. CVE-2026-82078 (CVSS 9.4) is unsafe dynamic class loading in database-connection utilities. The first emergency patch was bypassed; Release 2 landed August 28 after Huntress and watchTowr found extra routes; Release 3 (September 1) fixed SAML and legacy SQL Server regressions. CISA added both CVEs to KEV on August 31. The builds you want now are the later maintenance releases that absorbed all three emergencies: 24.1.10, 25.0.13, 26.0.5. Version 23 and older have no patch — upgrade the branch.

What Happened

PaperCut NG/MF is the print-management Java app that, by default on Windows, often runs as SYSTEM. Arctic Wolf and others dated initial exploitation to August 26. PaperCut's own timeline: emergency patch for v25/v26 on the 27th, CVE IDs and Release 2 (Windows/Linux/macOS, now including v24) on the 28th, Release 3 on September 1 as a cumulative. The company told customers they did not need to stack older emergencies — each new release accumulated the last — but they did need to keep moving when researchers found bypasses.

By September, GreyNoise and The Register were counting hundreds of victim orgs (education-heavy, US-weighted) and even AI-agent mass scanning. That is a September epilogue. The August fact is: internet-facing Application Servers on 24/25/26 were a zero-day RCE for several days, and the first patch was not the last word.

PaperCut also called out a security.properties change for sites that use Card/ID number lookup. Read the bulletin if that feature is on; skipping it can break lookups or leave a hardening gap.

Why It Matters

Print servers sit on the internal network, talk to every workstation's driver stack, and are boring enough to skip Patch Tuesday. Pre-auth RCE on that host is a domain-adjacent beachhead — the 2023 PaperCut mass events already taught ransomware crews the lesson. Three emergency drops in a week means "we patched Friday" can still be wrong on Monday. Maintenance releases that completed QA are the ones to standardize on.

Who Is Affected

  • PaperCut NG/MF 24.x before 24.1.10
  • 25.x before 25.0.13
  • 26.x before 26.0.5
  • 23.x and earlier — unsupported for this fix; move to a current train
  • Highest risk: Application Servers reachable from the internet (Shadowserver / Censys class exposure)
  • Site Servers and print providers behind a patched Application Server still need the same version discipline

How to Protect Yourself

1. Upgrade to a current maintenance release, not a leftover emergency installer.

# Linux Application Server — version is in the install dir / admin UI
ls /home/papercut/server/
# Windows: Programs and Features / PaperCut NG(MF) about screen

Install 26.0.5, 25.0.13, or 24.1.10 matching your train. If you are still on an "Emergency Patch Release 1/2/3" build, PaperCut wants you on the MR. v23: plan a version jump, do not wait for a 23.x hotfix.

2. Until it is patched, do not leave the Application Server on the internet. Restrict admin UI and server ports to print-VLAN / jump hosts. That is the same advice PaperCut has repeated since 2023.

3. Hunt like SYSTEM may already have run attacker code. Unexpected admin users, new local accounts, new services, outbound beacons from the print server, webshells under the PaperCut install tree, and scheduled tasks created around August 26 onward.

Get-LocalUser
Get-ScheduledTask | Where-Object { $_.Date -gt '2026-08-20' }
Get-ChildItem 'C:\Program Files\PaperCut NG','C:\Program Files\PaperCut MF' -Recurse -Include *.jsp,*.aspx,*.php,*.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt '2026-08-20' } | Select-Object FullName, LastWriteTime

4. Rotate anything the PaperCut service account could reach — AD bind password, database credentials, SMTP, payment integrations — if the server was exposed while vulnerable.

5. Apply the bulletin's security.properties guidance if you use card/ID lookup, then verify SAML and SQL Server card lookup still work after Release 3 / MR.

Source