CVE-2026-81578: Exploited PaperCut Authentication Bypass Chains to Pre-Auth RCE

PaperCut is responding to active attacks targeting its NG and MF print management platforms through a pair of zero-day vulnerabilities that can be chained to achieve unauthenticated remote code execution. One of the flaws, tracked as CVE-2026-81578, is a high-severity authentication bypass that enables a remote attacker to modify sensitive PaperCut configuration without first logging in.

Rated 8.8 on the CVSS v4.0 scale, the vulnerability exists in the web management interface and results from administrative actions being processed before access validation has fully completed. On its own, the flaw enables unauthorized configuration changes. Combined with the critical CVE-2026-82078 unsafe dynamic class-loading bug, however, the attack chain can result in arbitrary Java execution under the security context of the PaperCut Application Server.

The Exploited PaperCut Vulnerabilities have already been observed against customer environments. Huntress detected the first known attack activity on August 26, 2026 and reproduced a complete pre-authentication RCE chain against a standard PaperCut NG installation. CISA subsequently added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog, confirming that the threat has moved beyond proof-of-concept exploitation.

PaperCut now treats all versions of PaperCut NG and PaperCut MF as potentially impacted and has released Emergency Patch Release 3 for versions 24, 25, and 26. The latest emergency update supersedes the previous patches and adds additional hardening after researchers and defenders identified further attack paths against incompletely patched systems.

CVE-2026-81578 analysis

The vulnerability is classified as a missing-authentication or improper access control issue affecting PaperCut’s administrative web interface. Under specific conditions, a specially crafted unauthenticated request can reach backend administrative functionality before PaperCut completes the expected access-control checks.

The important details for CVE-2026-81578 involve the difference between the page presented to the requester and the backend action ultimately executed. Huntress found that a crafted request can reference one page to be rendered in the response while targeting a component or action belonging to another page. PaperCut’s vulnerable authorization logic can validate the rendered page rather than correctly enforcing the authorization requirements of the underlying component.

This allows an external attacker with no valid PaperCut account to interact with administrative functionality and alter trusted server configuration.

CVE-2026-81578 affects PaperCut NG and PaperCut MF. PaperCut’s current emergency advisory conservatively applies to all versions of both products while its incident response investigation remains active. PaperCut Hive and PaperCut Pocket are not impacted, while Mobility Print and Print Deploy server components use separate architectures and are also outside the scope of this vulnerability.

The authentication bypass becomes significantly more dangerous when combined with CVE-2026-82078. That second flaw exists in PaperCut’s database connection utilities and involves unsafe dynamic class loading. The software can instantiate database driver classes using configurable driver names without restricting them to an approved allowlist.

Normally, exploiting CVE-2026-82078 requires high privileges because the attacker needs the ability to manipulate the relevant configuration parameters. CVE-2026-81578 supplies that missing step: an unauthenticated attacker can first modify trusted server settings and then abuse the class-loading behavior to execute arbitrary Java bytecode already available on the application’s classpath.

In practice, that transforms two vulnerabilities with different prerequisite conditions into a pre-authentication RCE chain.

Huntress recreated the chain against PaperCut NG version 25.0.11.75758. In its test, a remote unauthenticated request caused charmap.exe to execute as SYSTEM beneath the PaperCut pc-app.exe Application Server process, demonstrating that successful exploitation can cross from an exposed web interface into operating-system command execution with highly privileged rights.

A working CVE-2026-81578 PoC is now publicly available for the combined CVE-2026-81578/CVE-2026-82078 attack chain, and public exploit references have also appeared in vulnerability databases and security tooling. That substantially reduces the barrier for scanning and exploiting unpatched internet-facing systems.

Real-world attacks were underway even before full public technical details emerged. Huntress observed exploitation in two customer environments, with the first incident occurring on August 26. One attack lasted less than two minutes and executed Base64-encoded reconnaissance commands that decoded to:

whoami & ver

A second incident extended the reconnaissance sequence to:

whoami & ver & tasklist

These commands allowed the attackers to determine the identity under which PaperCut was running, the Windows version, and active processes.

The attackers also delivered malicious Java .class files through the vulnerable server. Huntress recovered one payload as:

lib/Udydn.class

Researchers also observed an unusual in-memory Apache Derby database path ending in:

memory:C:\Program Files\PaperCut MF\server\data\internal\pwn

The second database boot event occurred immediately before code execution, making it a high-confidence forensic artifact for the observed attack chain.

PaperCut’s subsequent investigation shows that attacker behavior has since escalated beyond basic reconnaissance. The vendor describes a second wave against public-facing systems that were not fully patched, with more sophisticated post-compromise activity than what was seen during the first days of the campaign.

Later observed command sequences included domain and session reconnaissance with nltest, quser, and directory enumeration, followed by downloads of legitimate remote-access software. PaperCut documented attackers fetching a SimpleHelp agent and AnyDesk, with SimpleHelp installed as a persistent Windows service named Remote Access Service running as LocalSystem.

The activity shows why the authentication bypass should not be evaluated in isolation. Once chained to code execution, an internet-facing PaperCut Application Server can become an initial foothold for privileged remote access, discovery, persistence, and potentially further lateral movement.

The exact original discovery date has not been publicly disclosed. PaperCut first published its urgent advisory on August 27, 2026 after confirming active customer incidents, assigned CVE identifiers as the investigation developed, and released the initial emergency patch on August 28.

CISA added the vulnerability to its KEV catalog on August 31, 2026, with a remediation due date of September 14, 2026 for affected federal organizations subject to the directive. Known ransomware use is currently listed as unknown.

PaperCut and Huntress have now published useful CVE-2026-81578 IOCs, although defenders should remember that attackers can change payload names, infrastructure, and post-exploitation tools.

CVE-2026-81578 Mitigation

PaperCut’s primary recommendation is to remove PaperCut NG/MF Application Servers from direct internet exposure immediately. If an Application Server is publicly accessible, organizations should restrict its web interfaces to trusted IP addresses using firewall rules, network access controls, a VPN, or another controlled administrative access path. This should be done even when no suspicious activity has been observed.

For supported deployments, administrators should install Emergency Patch Release 3, published September 1, 2026. Release 3 supersedes Releases 1 and 2, so customers do not need to install the earlier emergency packages first. PaperCut recommends that internet-facing systems upgrade again even if Release 1 or Release 2 has already been installed.

The current emergency patches cover PaperCut NG/MF versions:

• 26
• 25
• 24

Organizations running version 23 or older should upgrade to a current supported version rather than wait for a separate emergency patch. PaperCut explicitly recommends upgrading pre-v24 installations to the latest available release.

Administrators should also patch Site Servers and secondary/print servers, not only the primary Application Server. PaperCut states that Mobility Print, Print Deploy servers, User Client software, Print Deploy clients, and the Mobility Print installer are not affected by this incident.

CVE-2026-81578 detection should start by identifying every PaperCut NG and MF Application Server and determining whether it was externally accessible at any time beginning at least August 26, when Huntress first observed exploitation.

To Detect CVE-2026-81578 exploitation or post-compromise activity, defenders should examine PaperCut logs, endpoint telemetry, network records, and filesystem activity for the following indicators:

• Suspicious child processes originating from pc-app.exe or pc-app
• Missing, deleted, or unexpectedly truncated server.log files
• ERROR No suitable driver found for jdbc:no:x
• ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
• DB URL: jdbc:derby:memory:pwn;create=true
• Database error looking up cardID: VALUES CAST(X’cafebabe
• DB URL: jdbc:no:x DB Driver: <5-char random name>
• Unexpected five-character .class files under <install>\server\lib\
• Corresponding .cmd or .out files under <install>\server\data\content\
• cmd.exe spawned by the PaperCut service
• Execution of whoami, ver, tasklist, nltest, or quser from the PaperCut process tree
• Unexpected SimpleHelp or AnyDesk deployment
• A Windows service named Remote Access Service
• SimpleService.exe running from the JWrapper-Remote Access directory

PaperCut cautions that attackers may delete temporary files as the attack progresses, so the absence of these artifacts does not prove that a system was never compromised.

Organizations should also preserve evidence before upgrading or rebooting an exposed system. Huntress recommends capturing the entire PaperCut server/logs directory, configuration state, process trees, reverse-proxy and firewall logs, DNS and network-flow records, and evidence of recently created services, scheduled tasks, autoruns, or files.

The CVE-2026-81578 mitigation process must go beyond patching when there is evidence of compromise. PaperCut recommends securing existing backups, completely wiping and rebuilding the Application Server, and restoring from a clean backup created before suspicious activity occurred.

Security teams should also review administrative credentials, service accounts, tokens, Active Directory access, and systems reachable from the compromised server. Because the PaperCut Application Server can run with SYSTEM or similarly privileged rights, successful exploitation can provide attackers with substantial post-compromise capability.

PaperCut’s rapid sequence of emergency patches also illustrates why defenders should confirm that they are running the latest mitigation rather than assuming an earlier hotfix is sufficient. Researchers discovered additional bypass paths after the first emergency release, Release 2 added further hardening, and Release 3 subsequently closed additional attack vectors observed in the wild.

Contact Sales