PaperCut Urges Patch for Actively Exploited Zero-Day RCE Flaws
PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released
Related Entities
Products & Tech
CVE Identifiers
Full Report
Executive Summary
Print management software vendor PaperCut has released emergency security patches to address a critical vulnerability chain that is being actively exploited in zero-day attacks. The flaws affect all versions of PaperCut NG and PaperCut MF software. When chained, the two vulnerabilities allow a remote, unauthenticated attacker to achieve remote code execution (RCE) on a vulnerable server. The company is treating the issue with the highest priority and has confirmed customer incidents. Security firm Huntress has also observed active exploitation. Customers are strongly urged to patch immediately or restrict access to their Application Servers from the internet.
Vulnerability Details
The attack combines two separate vulnerabilities:
CVE-2026-81578(CVSS 8.8 - High): An authentication bypass vulnerability. An attacker can exploit a flaw in the application's logic to trigger administrative functions before authentication checks are properly enforced. This allows them to modify system settings.CVE-2026-82078(CVSS 9.4 - Critical): An unsafe dynamic class-loading vulnerability. After using the first flaw to alter system configurations, an attacker can abuse a utility related to database connections to load and execute arbitrary Java bytecode. This leads to full remote code execution on the server.
The combination allows for a pre-authentication RCE, meaning an attacker needs no prior access or credentials to compromise the server. This makes any internet-exposed PaperCut server a critical risk.
Affected Systems
- Product: PaperCut NG (all versions)
- Product: PaperCut MF (all versions)
All deployments where the PaperCut Application Server is accessible from the internet are considered at high risk.
Exploitation Status
Active Exploitation: Yes. Both PaperCut and Huntress have confirmed that these vulnerabilities are being actively exploited in the wild. Huntress reported observing exploitation in at least two customer environments, where attackers were performing initial reconnaissance commands.
Impact Assessment
The impact of a successful exploit is severe. An attacker can gain full control over the PaperCut server, which is often integrated with Active Directory and has privileged access to the network. From this position, an attacker could:
- Steal sensitive documents that are processed by the print server.
- Pivot laterally into the broader corporate network.
- Deploy ransomware or other malware.
- Use the compromised server as a foothold for a persistent long-term attack.
Given that print servers are a ubiquitous part of enterprise environments, the potential attack surface is vast. The active exploitation status elevates this to a critical threat that requires immediate attention.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
- Process Name: Look for suspicious child processes spawning from the main PaperCut application process,
pc-app.exe. This could includecmd.exe,powershell.exe, or other unexpected binaries. - Log Source: Monitor PaperCut server logs (
server.log). Look for evidence of tampering, such as deleted or modified log files. - Log Pattern: Search logs for specific error messages mentioned by PaperCut, such as
"No suitable driver found for jdbc:no:x", which could indicate an exploitation attempt ofCVE-2026-82078. - Network Traffic: Monitor for outbound connections from the
pc-app.exeprocess to unknown IP addresses, which could be a C2 channel.
Detection Methods
- Vulnerability Scanners: Use vulnerability scanners with updated plugins to identify unpatched PaperCut servers in your environment.
- EDR/SIEM Queries:
- Search for child processes of
pc-app.exethat are not part of normal operation. - Create alerts for modifications or deletions of files in the PaperCut log directory:
[app-path]/server/logs/. - Ingest application logs into a SIEM and create rules to detect the specific error messages associated with exploitation.
- Search for child processes of
- This approach aligns with D3FEND's System Call Analysis (D3-SCA) and File Analysis (D3-FA).
Remediation Steps
- Immediate Patching: The highest priority is to apply the emergency patches released by PaperCut for all affected versions of PaperCut NG and PaperCut MF.
- Restrict Access (Workaround): If patching is not immediately possible, implement a strict firewall rule to block all inbound traffic to the PaperCut Application Server from the internet. Access should only be allowed from trusted internal IP addresses. This is a critical compensating control.
- Hunt for Compromise: After patching or restricting access, assume compromise. Use the observables and detection methods above to investigate for any signs of malicious activity on your PaperCut servers.
- Verification: After applying the patch, verify that the server is running the updated version and that any temporary firewall rules can be reviewed or removed as per your security policy.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to apply the emergency patches provided by PaperCut immediately.
Mapped D3FEND Techniques:
As a workaround, use a firewall to restrict all internet access to the PaperCut Application Server.
Mapped D3FEND Techniques:
Running the PaperCut service with the lowest possible privileges can help limit the impact of a successful RCE.
Mapped D3FEND Techniques:
Behavior Prevention on Endpoint
Use an EDR to monitor for suspicious child processes spawning from pc-app.exe, which can detect post-exploitation activity.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most critical and immediate action is to apply the emergency patches released by PaperCut. Due to the pre-authentication nature of this RCE and active exploitation, this should be treated as an emergency change. Prioritize all internet-facing PaperCut NG and MF servers. Organizations should activate their incident response and emergency patching procedures to deploy this update across all vulnerable assets within hours, not days. Verifying the successful installation of the patch is a mandatory follow-up step. For organizations with large fleets, using automated deployment tools like SCCM or Ansible is essential to ensure timely and complete remediation.
For any organization that cannot patch immediately, the primary compensating control is to block all internet access to the PaperCut Application Server at the network perimeter. Configure your edge firewall to deny inbound traffic to the ports used by PaperCut (typically 9191/TCP and 9192/TCP) from any external IP address. This effectively removes the attack surface from the public internet, mitigating the risk of remote exploitation. This should be considered a temporary measure until patching can be completed. This action directly addresses the remote and unauthenticated aspects of the vulnerability chain.
After patching, security teams must assume compromise and hunt for malicious activity. The most effective way to do this is through process analysis using an EDR tool. Specifically, hunt for any instances where the pc-app.exe process has spawned child processes like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. This is highly anomalous behavior for the PaperCut application and a strong indicator of post-exploitation activity. Create a detection rule to alert on this behavior in real-time. Reviewing historical process data for this pattern can help identify if a server was compromised before the patch was applied.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.