Executive Summary

    On August 31st, CISA added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities (KEV) catalog following confirmed exploitation of the flaws in PaperCut NG and MF. The two vulnerabilities can be chained to allow an unauthenticated attacker to remotely compromise affected PaperCut servers, with exploitation observed as early as August 26th.  

    PaperCut initially believed attacks involved a single vulnerability, but further investigation determined attackers were chaining the two flaws to bypass authentication and execute malicious code. Researchers also demonstrated that PaperCut’s initial emergency patch could be bypassed, requiring PaperCut to release a secondary emergency patch.  

    Public exploit code is now available, lowering the barrier for additional threat actors to reproduce the attack chain. Given confirmed in-the-wild exploitation, a public exploit, and PaperCut’s history of being targeted by established ransomware operators, Beazley Security strongly recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise. 

    Affected Systems or Products

    Product

    Affected Version

    Fixed Version

    PaperCut NG

    All versions prior to Emergency Patch Release 2

    v24  v25  v26

    PaperCut MF

    All versions prior to Emergency Patch Release 2

    v24  v25  v26

    *As of this writing, an official patch release is still being created by PaperCut. A second emergency patch was released for customers as of August 28, 2026. 

    Mitigations / Workarounds

     Both flaws are reached through the PaperCut Application Server’s web management interface, so the most effective interim step is to cut off that exposure until a patch is applied: 

    • Restrict web access to the PaperCut NG/MF Application Server to trusted, internal IP addresses only, using firewall rules or network access controls, even if no suspicious activity has been observed. 

    • Apply PaperCut’s Emergency Patch Release 2 to every affected instance, including Site Servers and secondary/print servers, not just the primary Application Server. Organizations that already applied the first emergency patch should still install Release 2, since researchers demonstrated bypasses against it.  

    • Organizations on PaperCut NG/MF v23 or earlier have no patch available and should upgrade to a supported, patched version as soon as possible. 

    If compromise is suspected, PaperCut recommends securing existing server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious activity, then activating standard incident response procedures. See the Indicators of Compromise section of this advisory for more information. 

    Patches

    PaperCut has released Emergency Patch Release 2 for the v24, v25, and v26 branches on Windows, Linux, and macOS, available through the vendor’s security bulletin. This is an emergency patch outside PaperCut’s normal release process, and the vendor says a fully validated official release covering both CVEs is still in progress.  

    Indicators of Compromise

    On August 31, CISA added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Huntress also documented post-exploitation activity across affected customer environments, providing several indicators defenders can use to identify potential compromise 

    Defenders should review affected PaperCut Application Servers for the following indicators of exploitation: 

    • Encoded discovery commands: Base64-encoded commands including whoami & ver and whoami & ver & tasklist. 

    • Unexpected Java class files: .class files written to the server/lib directory. Huntress observed Udydn.class and Moo97.class, although filenames may vary. 

    • Deleted or truncated logs: Attackers were observed deleting server.log and data/internal/derby.log to conceal activity. Missing or unexpectedly truncated log files should be treated as potential indicators. 

    • Suspicious Derby database references: Where derby.log remains available, review for unusual in-memory database references such as jdbc:derby:memory:pwn. 

    • Suspicious child processes: Review for pc-app.exe or its associated Java process spawning cmd.exe, PowerShell, or other unexpected processes. 

    • PaperCut log indicators: PaperCut identified ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST as potential indicators of exploitation. 

    Technical Details

    The exploit chain has two vulnerabilities. The first is CVE-2026-81578, an authentication bypass rooted in the PaperCut web management interface. This bypass can then be used to exploit CVE-2026-82078, allowing a threat actor to make malicious, unauthorized changes to the server configuration. 

    CVE-2026-82078 is a bug where the database connection utilities of PaperCut MF and NG will load drivers based on name, without validation. Third party security vendors have published details on verified breach incidents where threat actors leveraged this chain to write malicious Java class files to target hard drives, then execute them as the PaperCut server process. The malicious class files were backdoors that could execute arbitrary commands on a victim's machine. 

    How Beazley Security is responding

    Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. 

    We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients. 

    If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team. 

    Sources