By ByteBot
PaperCut pushed its second emergency patch in under 24 hours on August 28 — because the first one had bypasses. If your organization runs PaperCut NG or MF, attackers are already scanning for your server. Two freshly published CVEs chain together to give unauthenticated attackers full remote code execution. The clock is not in your favor.
Two Flaws, One Very Bad Outcome
The exploit requires two vulnerabilities working in sequence. CVE-2026-81578 (CVSS 8.8) is an improper access control flaw in PaperCut’s web management interface. A crafted HTTP request references one page for rendering but triggers administrative actions on a different page — and PaperCut’s auth checks only validate the rendered page, not the backend actions. The result: configuration changes without authentication.
That configuration access is the entry point for CVE-2026-82078 (CVSS 9.4). PaperCut loads database driver classes by name from its configuration without validating them against any allowlist. An attacker who can write to the config can inject a malicious class name. PaperCut then instantiates it — executing arbitrary Java code on the server. Jake Knott, head of threat intelligence at watchTowr, put it plainly: “CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution.”
No credentials required at any step.
The First Patch Did Not Hold
PaperCut released Emergency Patch Release 1 on August 27. Within hours, researchers at Huntress and watchTowr had identified bypass techniques. PaperCut shipped Emergency Patch Release 2 by 02:10 AEST on August 28. If you installed Release 1, that is not enough. You need Release 2.
Patches are available for PaperCut NG and MF on versions 24, 25, and 26 across Windows, Linux, and macOS. If you are running version 23 or earlier, there is no patch for your release. Your only option is to upgrade to a supported version before you do anything else.
What to Do Right Now
In order of priority:
- Apply Emergency Patch Release 2 for your version (24, 25, or 26). Get it from the PaperCut security bulletin.
- If on version 23 or earlier, upgrade immediately. Do not wait for a backport that is not coming.
- Restrict access to the PaperCut web management interface to trusted internal IP ranges only. Do not expose the Application Server to the internet while you arrange the patch.
Are You Already Compromised?
Huntress confirmed exploitation in the wild as early as August 26 — before PaperCut published anything publicly. Attackers were running base64-encoded recon commands in compromised environments: d2hvYW1pICYgdmVyICYgdGFza2xpc3Q= decodes to whoami & ver & tasklist. Standard initial reconnaissance.
Check for these indicators of compromise:
- Irregular Derby database boot log entry with a timestamp just before unexpected code execution
- Suspicious or missing
server.logfiles (attackers delete logs to cover tracks) - A Windows service named “Remote Access Service” running
SimpleService.exe - Unexpected AnyDesk installations
- Anomalous activity around
pc-app.exe, the main PaperCut Application Server executable
Absence of these indicators does not confirm a clean system. If your server was internet-facing before patching, treat it as potentially compromised and investigate properly.
History Says Act Fast
This is not PaperCut’s first critical RCE. CVE-2023-27350 followed the same pattern: pre-auth remote code execution, wide enterprise and education sector exposure, and within days, Clop and LockBit ransomware affiliates were actively exploiting it. The FBI flagged the Bl00dy Ransomware Gang targeting universities through that same vulnerability. Iranian state-backed actors joined in shortly after.
PaperCut runs in universities, hospitals, and enterprises at massive scale — over 100 million users across 70,000+ organizations. Ransomware operators know this. They operationalize these exploits fast. The Huntress research and the Rapid7 analysis both confirm active exploitation is already underway. The window for proactive patching is shrinking by the hour.
Patch. Then check your logs. Then restrict network access. In that order.
