PaperCut Urges Patch for Actively Exploited Zero-Day RCE Flaws

Executive Summary

Print management software vendor PaperCut has released emergency security patches to address a critical vulnerability chain that is being actively exploited in zero-day attacks. The flaws affect all versions of PaperCut NG and PaperCut MF software. When chained, the two vulnerabilities allow a remote, unauthenticated attacker to achieve remote code execution (RCE) on a vulnerable server. The company is treating the issue with the highest priority and has confirmed customer incidents. Security firm Huntress has also observed active exploitation. Customers are strongly urged to patch immediately or restrict access to their Application Servers from the internet.

Vulnerability Details

The attack combines two separate vulnerabilities:

1. CVE-2026-81578 (CVSS 8.8 - High): An authentication bypass vulnerability. An attacker can exploit a flaw in the application's logic to trigger administrative functions before authentication checks are properly enforced. This allows them to modify system settings.
2. CVE-2026-82078 (CVSS 9.4 - Critical): An unsafe dynamic class-loading vulnerability. After using the first flaw to alter system configurations, an attacker can abuse a utility related to database connections to load and execute arbitrary Java bytecode. This leads to full remote code execution on the server.

The combination allows for a pre-authentication RCE, meaning an attacker needs no prior access or credentials to compromise the server. This makes any internet-exposed PaperCut server a critical risk.

Affected Systems

• Product: PaperCut NG (all versions)
• Product: PaperCut MF (all versions)

All deployments where the PaperCut Application Server is accessible from the internet are considered at high risk.

Exploitation Status

Active Exploitation: Yes. Both PaperCut and Huntress have confirmed that these vulnerabilities are being actively exploited in the wild. Huntress reported observing exploitation in at least two customer environments, where attackers were performing initial reconnaissance commands.

Impact Assessment

The impact of a successful exploit is severe. An attacker can gain full control over the PaperCut server, which is often integrated with Active Directory and has privileged access to the network. From this position, an attacker could:

• Steal sensitive documents that are processed by the print server.
• Pivot laterally into the broader corporate network.
• Deploy ransomware or other malware.
• Use the compromised server as a foothold for a persistent long-term attack.

Given that print servers are a ubiquitous part of enterprise environments, the potential attack surface is vast. The active exploitation status elevates this to a critical threat that requires immediate attention.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

• Process Name: Look for suspicious child processes spawning from the main PaperCut application process, pc-app.exe. This could include cmd.exe, powershell.exe, or other unexpected binaries.
• Log Source: Monitor PaperCut server logs (server.log). Look for evidence of tampering, such as deleted or modified log files.
• Log Pattern: Search logs for specific error messages mentioned by PaperCut, such as "No suitable driver found for jdbc:no:x", which could indicate an exploitation attempt of CVE-2026-82078.
• Network Traffic: Monitor for outbound connections from the pc-app.exe process to unknown IP addresses, which could be a C2 channel.

Detection Methods

• Vulnerability Scanners: Use vulnerability scanners with updated plugins to identify unpatched PaperCut servers in your environment.
• EDR/SIEM Queries:
  • Search for child processes of pc-app.exe that are not part of normal operation.
  • Create alerts for modifications or deletions of files in the PaperCut log directory: [app-path]/server/logs/.
  • Ingest application logs into a SIEM and create rules to detect the specific error messages associated with exploitation.
• This approach aligns with D3FEND's System Call Analysis (D3-SCA) and File Analysis (D3-FA).

Remediation Steps

1. Immediate Patching: The highest priority is to apply the emergency patches released by PaperCut for all affected versions of PaperCut NG and PaperCut MF.
2. Restrict Access (Workaround): If patching is not immediately possible, implement a strict firewall rule to block all inbound traffic to the PaperCut Application Server from the internet. Access should only be allowed from trusted internal IP addresses. This is a critical compensating control.
3. Hunt for Compromise: After patching or restricting access, assume compromise. Use the observables and detection methods above to investigate for any signs of malicious activity on your PaperCut servers.
4. Verification: After applying the patch, verify that the server is running the updated version and that any temporary firewall rules can be reviewed or removed as per your security policy.