PaperCut RCE Chain Requires Emergency Patch Release 2

The CISA alert covers an authentication-bypass flaw and an unsafe dynamic class-loading flaw that can be chained into pre-authentication remote code execution on PaperCut’s server software. PaperCut’s August 31 advisory says confirmed customer incidents exist, while Huntress reports it observed exploitation in two customer environments and reproduced the attack chain against a stock PaperCut NG installation. Canada’s Cyber Centre separately warned on August 28 that both CVEs were being exploited in the wild.

This is a Windows infrastructure issue, even though PaperCut also runs on Linux and macOS. PaperCut servers commonly sit beside Active Directory, SQL Server, print queues, and managed endpoints; an Application Server process that can launch commands under its existing service context is a foothold worth treating as a potential domain-security incident, not a printer-service outage.

The two CVEs form the dangerous path​

CVE-2026-81578 affects the PaperCut NG/MF web management interface. According to PaperCut, specially formed unauthenticated requests can cause backend administrative actions before access validation completes, allowing an external attacker to alter certain server configuration. That configuration access is the bridge to the second issue.

CVE-2026-82078 sits in PaperCut’s database connection utilities. PaperCut says the software can instantiate database-driver classes based on configurable driver names without an allowlist of approved classes. If an attacker can manipulate those parameters, arbitrary Java bytecode already placed on the application classpath can run in the security context of the PaperCut server process.

PaperCut assigns CVSS 4.0 scores of 8.8 to CVE-2026-81578 and 9.4 to CVE-2026-82078. The score difference should not drive triage: the operational risk is the chain. Huntress says the authentication bypass permits remote configuration takeover and that the class-loading issue converts it into remote code execution without valid PaperCut credentials.

There is a small but telling classification discrepancy in the public records. CISA describes CVE-2026-81578 as missing authentication for a critical function, and PaperCut maps it to CWE-306, while the published CVE record describes an improper access-control weakness and maps it to CWE-305. The technical descriptions agree on the important point: unauthenticated requests can reach protected administrative behavior before authorization is properly enforced. Defenders should not let taxonomy obscure the response priority.

Emergency Patch Release 2 supersedes PaperCut’s first fix​

PaperCut originally issued an emergency patch on August 28 for its version 25 and 26 branches. Later that day it published Emergency Patch Release 2, saying further analysis with its internal security team, Huntress, and watchTowr produced additional hardening beyond the initial fix. BleepingComputer reported that researchers had identified multiple ways around the original patches and an additional authentication-bypass issue.

PaperCut explicitly recommends installing Release 2 even if the first emergency patch is already present. Release 2 is now available for PaperCut NG and PaperCut MF versions 24, 25, and 26, including Windows installers. The vendor says all releases are potentially affected, and customers running version 23 or older must upgrade to a supported current branch rather than wait for a patch.

That last point deserves attention in Windows fleets with long-lived print infrastructure. PaperCut frequently remains in place after server operating-system upgrades, printer refreshes, or changes in ownership between desktop engineering and facilities teams. An inventory that only checks the central Application Server can also miss Site Servers and secondary or print servers. PaperCut says those systems must be updated to a patched version as well; Print Deploy and Mobility Print are not affected by these two CVEs.

Release 2 is still an emergency patch rather than PaperCut’s ordinary release. The vendor says it has received reports of external database Card/ID lookup and SAML problems after installation. Organizations using SQL Server for external card lookups, particularly with the legacy SourceForge jTDS driver, should validate that workflow immediately after patching. PaperCut recommends moving to the supported Microsoft SQL JDBC driver and, for users of the external lookup feature, enabling the relevant security.card-number-lookup.enabled setting in server/security.properties.

That is a real maintenance risk, but it is not a reason to defer remediation. Schedule a short, controlled validation window if possible; if the server is publicly accessible, remove its exposure first and treat availability tradeoffs as secondary to containing an actively exploited remote-code-execution route.

Internet exposure is the first control to change​

PaperCut’s most direct instruction is to restrict Application Server web access to trusted IP addresses immediately. It recommends firewall rules, network-access controls, or comparable measures to prevent the service’s web interfaces from being reached from untrusted internet addresses—even if no suspicious activity has been detected.

This is more than generic defense-in-depth. The exploitation chain described by Huntress begins with remote, unauthenticated interaction with the PaperCut web application. Removing public access therefore cuts off the observed initial-access path while an organization patches, validates dependencies, and begins threat hunting.

Administrators should confirm actual exposure rather than relying on an intended network diagram. Check external firewall and NAT rules, reverse proxies, cloud security groups, VPN split-tunneling exceptions, temporary vendor-support rules, and DNS records pointing at PaperCut hosts. Also review whether the administration interface is unintentionally reachable through an internal guest, wireless, or contractor network that is effectively untrusted.

The CISA KEV entry has particular consequence for U.S. federal civilian executive branch agencies under Binding Operational Directive 26-04, which requires risk-based prioritization for listed vulnerabilities. But the alert is just as relevant to schools, healthcare organizations, local government, and businesses using PaperCut: CISA’s inclusion is based on evidence that exploitation is happening, not a theoretical vendor severity rating.

Windows defenders should hunt before the upgrade erases evidence​

Patching closes the reported route but does not establish whether it was used. PaperCut advises organizations that suspect compromise to secure current backups, wipe and rebuild the Application Server, and restore from a clean backup taken before suspicious activity. That guidance is appropriately severe because the chain can yield command execution within the Application Server’s security context.

PaperCut and Huntress have published practical Windows-focused investigation leads. On a potentially exposed server, preserve PaperCut logs, configuration files, endpoint telemetry, firewall and proxy logs, and the current file-system state before an upgrade, reboot, or cleanup job changes the evidence. Pay close attention to server.log, including missing, truncated, or unexpectedly deleted copies.

The vendor identifies several logs and artifacts worth reviewing:

• pc-app.exe or pc-app spawning cmd.exe, PowerShell, discovery utilities, or other unexpected child processes is suspicious and should be investigated in context.
• server.log entries containing jdbc:no:x, jdbc:derby:memory:pwn, unusual five-character driver names, or database lookup errors involving VALUES CAST warrant immediate review.
• Unexpected .class files under the PaperCut server\lib path, plus matching .cmd and .out files under server\data\content, are high-value forensic leads.
• A Windows service named Remote Access Service running SimpleService.exe from a JWrapper-Remote Access directory, or an unexpected AnyDesk installation, may indicate follow-on remote-access tooling in the activity PaperCut describes.

Huntress observed base64-encoded reconnaissance commands resolving to whoami, ver, and tasklist, and reported reproducing an exploit that launched charmap.exe as SYSTEM under pc-app.exe. Elastic has already published a Windows detection rule focused on suspicious child processes from pc-app.exe, including shells, PowerShell, certutil.exe, bitsadmin.exe, whoami.exe, tasklist.exe, nltest.exe, and other common post-compromise tools.

None of those indicators is exhaustive. PaperCut warns that attackers may remove files and logs as their activity progresses, so the absence of a specific .class file or a particular log line does not clear an exposed host. A system with external exposure, an unpatched build, and incomplete telemetry should be assessed as a probable incident until the investigation establishes otherwise.

Patch status is now a security-control question​

CISA’s KEV addition changes the reasonable default for PaperCut NG/MF maintenance. A normal quarterly upgrade plan is no longer sufficient for an Application Server that can be contacted from the internet or from poorly segmented networks. The minimum defensible posture is Release 2 or a later official PaperCut build for every supported server, closed web access from untrusted networks, and retrospective review of the published indicators.

PaperCut said on August 31 that its team was still working toward an official release and had no new information to report beyond the emergency-patch guidance. Until that release arrives, the important distinction is simple: Release 2 is the currently available remediation for versions 24 through 26, while version 23 and older require an upgrade path. Any Windows PaperCut server left public-facing and unpatched is now carrying two cataloged, actively exploited flaws that attackers have already demonstrated can become remote code execution.