PaperCut Emergency Patch: Release 2 Fixes Exploited RCE Chain
Barely 19 hours after releasing an emergency patch for PaperCut NG and MF, the company had to prepare a replacement. Researchers uncovered several ways to circumvent the original safeguard, and they also identified yet another authentication-bypass variant. PaperCut has since issued Emergency Patch Release 2 and urges even administrators who already applied the first fix to install the new version.
How the Timeline Unfolded
The saga began on 27 August, when PaperCut warned of real attacks against customer servers. At first, the company withheld technical details and withheld even the CVE identifiers, so that administrators would have time to close off access to vulnerable systems. The first emergency update for branches 25 and 26 arrived on 28 August at 02:10 Australian time. By 20:42 that same day, PaperCut published Release 2 with additional hardening developed alongside Huntress and watchTowr. Later, the second fix was extended to branch 24 as well.
Two Vulnerabilities Behind the Zero-Day
The initially unknown zero-day turned out to be a chain of two vulnerabilities. CVE-2026-81578 earned a score of 8.8 out of 10 and lets a remote, account-less user reach PaperCut’s administrative functions and alter certain settings. The problem lies in how the web interface verified access rights. A specially crafted request could display one page available without authorization while simultaneously triggering a component from another, protected administrative page. The permission check keyed on the displayed page and overlooked the action running in the background.
Once the configuration has been changed, CVE-2026-82078, scored at 9.4, comes into play. PaperCut allowed database driver classes to be specified through settings and did not check the chosen class against an approved list. Having gained the ability to modify the configuration via the first flaw, an attacker could force the server to load arbitrary Java code from the application classpath. Consequently, the two errors combine into full-fledged, unauthenticated remote code execution.
A Fully Reproduced Attack Chain
Huntress managed to reproduce the chain entirely on a standard installation of PaperCut NG 25.0.11.75758. During the demonstration, the researchers remotely launched the Windows application charmap.exe as SYSTEM through the PaperCut pc-app.exe process. Such a privilege level grants an attacker almost total control over the server.
Not Merely a Lab Proof of Concept
This is no mere laboratory proof of concept. Huntress detected exploitation in at least two customer infrastructures. In one case, an attack on 26 August took less than two minutes. The intruders ran the commands whoami and ver to determine the username and Windows version. In the second incident, on 27 August, they added tasklist to obtain a list of running processes.
Malicious Java Files Left Behind
The researchers also found Java files uploaded to the server, namely Udydn.class and Moo97.class. The code could execute commands on both Windows and Linux, read and write files, and gather system information. Afterwards, the malicious class attempted to delete the files it had created along with the server.log journal, thereby hampering investigation. So far, Huntress has seen no installation of additional malware, no persistence, and no further activity through command servers. The observed behaviour resembles reconnaissance or a test of the exploit’s viability.
The First Patch Falls to Scrutiny
The situation grew still more dangerous after analysis of the first emergency update. watchTowr reported that its researchers had fully reproduced the vulnerabilities, found several ways to bypass the original patch, and discovered an additional authentication-bypass mechanism. Huntress likewise informed PaperCut of several bypasses of the first fix. It was precisely after such scrutiny that Release 2 emerged with additional reinforcement. As yet, there is no evidence that real attackers have already applied a bypass of the first patch.
Affected Versions and Patch Availability
PaperCut considers all versions of NG and MF potentially affected. Emergency Patch Release 2 has been released for branches 24, 25, and 26 on Windows, Linux, and macOS. Users of version 23 and older releases are advised to migrate to a current branch. It is not only the main Application Server that must be updated, but also Site Servers and secondary print servers. Print Deploy and Mobility Print fall outside the scope of the two vulnerabilities.
Why a Patch Alone Is Not Enough
PaperCut does not yet regard a patch alone as a sufficient measure. The company advises removing the Application Server web interface from the open internet and permitting access only from trusted addresses or through a controlled administrative channel. According to Shadowserver, around a thousand PaperCut servers remained reachable online at the time of disclosure, most of them in North America and Europe.
Indicators Administrators Should Check
Administrators are advised to look for suspicious processes launched from pc-app.exe, unexpectedly deleted or truncated server.log files, unknown .class files in the server/lib directory, and errors such as “No suitable driver found for jdbc:no:x” or “Database error looking up cardID: VALUES CAST.” Should a breach be suspected, PaperCut recommends going beyond an update: rebuilding the Application Server entirely and restoring data from a clean backup created before any signs of attack.
Echoes of 2023
PaperCut has weathered a similar episode before. In 2023, the vulnerability CVE-2023-27350 permitted authentication bypass and code execution on the server. Various criminal groups swiftly began exploiting the hole. CISA and the FBI linked PaperCut attacks to the Bl00dy ransomware gang, and later the exploitation of CVE-2023-27350 was observed among LockBit operators and other groups. In some attacks, a PaperCut breach became the initial point of entry into the internal network.
A Familiar and Unwelcome Pattern
The new chain repeats the most troubling part of the 2023 scenario. A print-management server often sits inside the corporate network and runs with high privileges, while attacking a vulnerable system requires neither a password nor prior access. Now an additional risk factor joins the active exploitation. The first attempt to close the hole did not survive researcher scrutiny, so administrators who installed the original emergency patch will have to update once again.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
