PaperCut RCE Chain: CVE-2026-82078 Exploited

PaperCut disclosed two vulnerabilities in PaperCut NG and PaperCut MF that can be chained into a pre-authentication Remote Code Execution (RCE) path against vulnerable Application Servers.

The flaws are CVE-2026-82078, an unsafe dynamic class-loading vulnerability, and CVE-2026-81578, an authentication bypass issue in the web management interface. PaperCut has confirmed active exploitation and customer incidents, so exposed deployments should be treated as emergency remediation priorities.

What Is CVE-2026-82078?

CVE-2026-82078 (CVSSv4.0 9.4) is an unsafe dynamic class-loading vulnerability in PaperCut database connection utilities. It is mapped to CWE-470, which covers externally controlled input used to select classes or code.

In practical terms, PaperCut could instantiate database-driver classes based on configurable driver names without validating them against an approved allowlist. If an attacker can manipulate the relevant configuration, the server may load an attacker-selected class already available on the application classpath, leading to arbitrary Java bytecode execution in the PaperCut server process.

By itself, CVE-2026-82078 has a high privilege prerequisite. The risk increases sharply when chained with CVE-2026-81578.

How Does CVE-2026-81578 Enable the RCE Chain?

CVE-2026-81578 (CVSSv4.0 8.8) is an authentication bypass vulnerability in the PaperCut NG/MF web management interface. It is mapped to missing authentication for a critical function.

PaperCut says unauthenticated remote requests targeting administrative functions can, under specific conditions, trigger backend actions before access validation is complete. That can allow an attacker to modify certain system configurations.

Chained together, CVE-2026-81578 can provide the unauthenticated configuration change needed to reach CVE-2026-82078, resulting in pre-authentication RCE in the PaperCut Application Server. Researchers also described the pair as a chain that enables pre-authentication remote code execution.

Which PaperCut Versions Are Affected?

PaperCut says the advisory applies to all versions of PaperCut NG and PaperCut MF. Emergency Patch Release 2 is available for the v24, v25, and v26 branches, and PaperCut recommends installing Release 2 even if the original emergency patch was already applied.

The CVE record for CVE-2026-82078 lists affected versions as those before 24.1.10, 25.0.13, and 26.0.5. Administrators should still use PaperCut’s current advisory and release guidance as the source of truth for deployment-specific validation.

Is CVE-2026-82078 Actively Exploited?

Yes. PaperCut said its security response team is investigating active exploitation affecting PaperCut NG and MF and that it is aware of confirmed customer incidents. Its August 31 update said the investigation was still ongoing.

Huntress reported limited exploitation in two customer environments and said observed activity included base64-encoded discovery commands such as whoami & ver. They also reproduced the chain and described CVE-2026-81578 and CVE-2026-82078 as enabling pre-authentication RCE when combined.

Available reporting points to targeted exploitation and reconnaissance activity rather than confirmed ransomware deployment or widespread data theft, though that assessment may change as investigations continue.

You can protect your organization from these actively exploited PaperCut vulnerabilities by leveraging SOCRadar’s Cyber Threat Intelligence module to monitor emerging risks and Attack Surface Management (ASM) module to secure exposed infrastructure. Key capabilities include:

• Track emerging vulnerabilities, vendor advisories, and exploitation updates.
• Identify internet-facing assets and exposed services.
• Verify patches and assess infrastructure for potential compromise.

What Should Defenders Do Now?

Take these steps immediately:

• Remove PaperCut Application Server web interfaces from public internet exposure.
• Restrict access to trusted IP ranges, internal networks, firewall-controlled paths, or VPN.
• Install Emergency Patch Release 2 on supported v24, v25, and v26 deployments.
• Upgrade v23 and earlier deployments to a supported fixed release.
• Upgrade Site Servers and secondary or print servers where applicable.
• Verify the installed version and confirm access controls block untrusted web access.

PaperCut specifically recommends restricting public web access even if no suspicious activity has been observed. The company also recommends Release 2 because it adds hardening beyond the first emergency patch.

How Can Defenders Hunt for Exploitation?

PaperCut lists several indicators and investigation leads. Review PaperCut logs, filesystem activity, web access logs, EDR telemetry, and process activity for signs such as:

• suspicious pc-app.exe or pc-app child processes,
• missing, truncated, or deleted server.log files,
• No suitable driver found for jdbc:no:x,
• Database error looking up cardID: VALUES CAST,
• jdbc:derby:memory:pwn;create=true,
• strings beginning with cafebabe (the magic bytes identifying Java class files),
• unexpected five-character .class files in the server lib directory,
• unexpected .cmd or .out files in the PaperCut data content directory,
• discovery commands involving accounts, operating-system details, running processes, domain controllers, users, or directories.

PaperCut warns that attackers may clean up files and logs, so absence of these indicators does not prove a system was not affected. Preserve evidence before rebuilding or cleaning systems.