Threat reportVulnerabilityTL-2026-2184
PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation
PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & (TL-2026-2184) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-08-28 and last reviewed 2026-10-09. It is linked to a Russia-nexus actor with medium confidence, affects PaperCut PaperCut NG, references 5 CVEs (CVE-2026-82078, CVE-2026-81578, CVE-2021-42278), maps to 48 MITRE ATT&CK techniques (T1003, T1003.001, T1003.003), and is covered by 9 detection rules and 105 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 48MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 105Indicators of compromise
Key facts for TL-2026-2184
- Threat ID
- TL-2026-2184
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- UNKNOWN
- Target sectors
- education, government administration, corporate, managed-print-services
- Detection rules
- 9
- Indicators of compromise
- 105
- Updates
- 2026-10-09 · 10 updates · revalidated 10× · latest source
How PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & works
PaperCut disclosed and emergency-patched two chained vulnerabilities in PaperCut NG/MF print management software: CVE-2026-81578, an unauthenticated web-management-interface access-control bypass (CVSS 8.8), and CVE-2026-82078, an unsafe dynamic class-loading flaw enabling arbitrary Java bytecode execution (CVSS 9.4). Huntress confirmed pre-authentication RCE exploitation against at least two customer environments, and PaperCut's initial 27 Aug 2026 patch proved insufficient, requiring a same-week Release 2 hardening build co-developed with Huntress and watchTowr.
PaperCut Software issued an URGENT, out-of-cycle security bulletin on 27 August 2026 (2:10 a.m. AEST) disclosing two vulnerabilities in PaperCut NG and PaperCut MF, its print management platform deployed across universities, corporations, and government organizations and compatible with Canon, Epson, Xerox, Brother, and other printer brands.
CVE-2026-81578 (CVSS 8.8, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N) is an improper access control flaw in the web management interface: under specific conditions, a crafted request can reference one page for rendering while another page's component or action executes on the backend, allowing unauthenticated remote requests to trigger administrative actions before access-validation checks complete. This lets an unauthenticated attacker modify system configuration, including database connection settings.
CVE-2026-82078 (CVSS 9.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, CWE-470) is an unsafe dynamic class-loading vulnerability in PaperCut's database connection utilities: the application loads JDBC database driver classes without validating them against an approved allow-list, so an attacker who can manipulate the JDBC driver configuration parameter can force PaperCut to load and execute arbitrary attacker-supplied Java bytecode.
Chained together, the two flaws produce a pre-authentication remote code execution path: CVE-2026-81578 lets an unauthenticated attacker reach and rewrite the JDBC connection configuration that would otherwise require high privilege, and CVE-2026-82078 turns that rewritten configuration into arbitrary code execution inside the pc-app.exe Application Server process. Huntress independently reproduced the full chain against a pre-patch build (PaperCut NG 25.0.11.75758) and documented two live customer compromises (26 and 27 August 2026) in which attackers delivered hex-encoded malicious Java .class files (observed as Udydn.class and Moo97.class) into PaperCut's server lib directory via an attacker-controlled SMB2 share carrying Apache Derby archives, then executed base64-encoded reconnaissance commands (whoami & ver, later expanded to whoami & ver & tasklist), wrote output to companion .out files, and deleted server.log, derby.log, and the output artifacts to erase evidence. Each observed compromise lasted under two minutes, consistent with automated or scripted probing rather than a sustained post-exploitation campaign; no persistence or lateral movement was documented in either incident.
A university customer's internal security team is credited with first identifying the suspicious activity that led to discovery. PaperCut's initial emergency patch (27 August, v25/v26 branches, Windows/Linux/macOS) proved insufficient; a revised Emergency Patch Release 2 with additional hardening was issued the next day (28 August) after further work with Huntress and watchTowr, and PaperCut urged all customers to install Release 2 even if Release 1 was already applied. As of 28 August 2026, a patch for the older v24 branch remained in development. PaperCut has prior history of mass-exploited vulnerabilities: CVE-2023-27350/CVE-2023-27351 were exploited by the Bl00dy and Clop ransomware operations and by an Iranian state-backed actor against critical infrastructure in 2023, raising concern about campaign-scale escalation of this new chain. As of this writing, neither CVE-2026-82078 nor CVE-2026-81578 had yet appeared in the CISA Known Exploited Vulnerabilities catalog.
MITRE ATT&CK techniques used in TL-2026-2184
Credential Access
T1003 OS Credential Dumping: Security Account Manager; T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS; T1552 Unsecured Credentials: Credentials In Files
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash
Defense Evasion
T1027 Obfuscated Files or Information; T1027.010 Obfuscated Files or Information: Command Obfuscation; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1112 Modify Registry; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Defense Evasion; T1562 Impair Defenses; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery: Local Account; T1087 Account Discovery: Domain Account; T1482 Domain Trust Discovery; T1613 Container and Resource Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.007 Command and Scripting Interpreter: JavaScript
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078.002 Valid Accounts: Domain Accounts; T1134.001 Access Token Manipulation: Token Impersonation/Theft
Command and Control
T1071 Application Layer Protocol: Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Software; T1572 Protocol Tunneling
Persistence
T1098 Account Manipulation; T1136 Create Account: Local Account; T1136.002 Create Account: Domain Account; T1505.003 Server Software Component: Web Shell; T1543 Create or Modify System Process: Windows Service
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool; T1588.005 Obtain Capabilities: Exploits
Reconnaissance
Affected products and versions in PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
Remediation for PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
Patches
- PaperCut NG/MF 24.1.10 (in development as of 28 Aug 2026)
- PaperCut NG/MF 25.0.13
- PaperCut NG/MF 26.0.5
- Emergency Patch Release 2 (28 Aug 2026) supersedes the insufficient 27 Aug 2026 Release 1 emergency build
Immediate actions
- Apply PaperCut's Emergency Patch Release 2 (28 Aug 2026) immediately, even if the original 27 Aug 2026 Release 1 build was already applied
- Use firewall rules or network access controls to ensure PaperCut NG/MF web management interfaces cannot be reached from untrusted internet addresses, even absent observed suspicious activity
- Remove internet-facing PaperCut Application Servers from direct public exposure until patched
Workarounds
- Restrict PaperCut web management interface access to trusted/internal IP ranges via firewall rules until the patch is applied
Longer-term hardening
- Alert on suspicious child-process or command execution originating from the pc-app.exe Application Server process
- Monitor for missing, unexpectedly truncated, or deleted PaperCut server.log or derby.log files as a compromise indicator
- Restrict PaperCut server outbound SMB access to prevent payload delivery via attacker-controlled SMB shares
- Hunt for unexpected .class files in the PaperCut server lib directory
CVEs associated with PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
CVE-2026-82078, CVE-2026-81578, CVE-2021-42278, CVE-2021-42287, CVE-2026-82077
Weaknesses (CWE) in PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
Timeline of PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
Showing the 20 most recent tracked events.
- The Record, Help Net Security, The Hacker News, and Cybersecurity News publish coverage confirming active exploitation and the two-stage emergency patch cycle.
- PaperCut releases a revised Emergency Patch Release 2 with additional hardening, developed with Huntress and watchTowr, after the original emergency patch proves insufficient; all customers are urged to install it even if Release 1 was already applied.
- PaperCut publicly states it is 'aware of confirmed customer incidents and is treating this matter with the highest priority,' noting the v24 branch patch remains in development.
- watchTowr discloses additional patch bypasses affecting the latest, fully patched Emergency Patch Release 2 builds — on top of the earlier Release 1 bypasses already remediated — meaning network-level exposure reduction remains necessary even for fully patched instances.
- watchTowr honeypot captures a full intrusion: user-lookup connector reconfigured, in-memory Godzilla and suo5 servlet filters deployed in two waves, configuration restored; a human operator connects from a second IP about 18 seconds later.
- BleepingComputer reports on PaperCut's Emergency Patch Release 2, reiterating that organizations that applied only Release 1 remain unprotected.
- watchTowr discovers WT-2026-0144 / CVE-2026-82077, a post-auth RCE via Scan to Fax path traversal.
- eSentire detects an intrusion at an education-sector customer running PaperCut MF 24.0.2 (build 69746); attackers deploy an in-memory Java loader and web shell, then AdaptixC2, and reach the domain controller in under 48 hours.
- Threat actor pivots from manual/targeted testing to mass, AI-agent-orchestrated exploitation using an OpenAI Codex harness driving a DeepSeek model; at peak, 11 organizations are compromised within a 26-second window.
- CISA adds both CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities catalog with a remediation deadline of 14 September 2026 under BOD 26-04.
- PaperCut releases 26.0.4-PO build 76530 fixing WT-2026-0143.
- Victims are recorded in 28 countries nominally on the operator's avoid-list (including Russia, China, and Iran), indicating the autonomous AI agents exceeded the operator's own targeting constraints ('Agents Gone Wild').
- Fastest observed Domain Admin escalation occurs at a U.S. high school, reaching Domain Admin in approximately five to seven minutes from initial access, via LSASS harvesting, noPac, or rogue-account injection followed by DCSync theft of NTDS.DIT.
- PaperCut ships Emergency Patch Release 3, superseding Releases 1 and 2 after researchers found the Home/Exception display-page bypass still worked against them.
- Arctic Wolf Labs publishes an advisory documenting sustained post-exploitation activity across multiple education-sector victims: BootKey/SAM credential theft via lsa_collect.exe and save_hives.exe, Meterpreter Java payload deployment, SimpleHelp and AnyDesk RMM installation, and config-file scraping for LDAP/API credentials.
- Security Affairs and other outlets report a widespread exploitation campaign targeting K-12 schools and major universities across the United States and Europe.
- PaperCut releases 26.0.5 fixing WT-2026-0144 / CVE-2026-82077.
- GreyNoise, GBHackers, and CyberSecurityNews jointly disclose the AI-orchestrated campaign's scope: 440 compromised PaperCut instances across 395 organizations in 48 countries, with education the dominant target vertical (204 victims), followed by retail/commercial, real estate/hospitality, and IT/MSP.
- Cyber Security News publishes the eSentire-sourced account of the PaperCut-to-domain-controller AdaptixC2 intrusion.
- watchTowr publishes 'Death By A Thousand PaperCuts' with the full chain, patch bypasses WT-2026-0141 to 0144, and a Detection Artifact Generator on GitHub.
Update history for TL-2026-2184
- 2026-10-09 — PaperCut NG/MF Pre-Auth RCE Chain and Patch Bypasses (WT-2026-0141-0144; CVE-2026-81578, CVE-2026-82077, CVE-2026-82078): What changed No severity, exploitability, status or CVSS change (already CRITICAL / ACTIVE / 9.4). Adds a third vulnerability, CVE-2026-82077 (WT-2026-0144, post-auth Scan to Fax RCE, fixed in 26.0.5), and WT-2026-0143, a setup-wizard pre-a
- 2026-09-30 — PaperCut MF/NG exploitation (CVE-2026-81578, CVE-2026-82078) used to pivot from print server to domain controller with AdaptixC2: What changed No field escalation (already ACTIVE / CRITICAL). New documented intrusion adds an in-memory Java loader and Tomcat web shell (which also blocked other actors from reusing the flaw), AdaptixC2 delivered as a trojanized Microsoft
- 2026-09-10 — AI-Orchestrated Campaign Exploits PaperCut NG/MF Auth Bypass + Unsafe Reflection RCE (CVE-2026-81578, CVE-2026-82078) to Compromise 440 Servers: What changed Attribution escalates from Unattributed/LOW confidence to a likely Russian-speaking actor cluster at MEDIUM confidence (nation_state Unknown → Russia), per GreyNoise infrastructure/operational-pattern analysis. The exploitation
- 2026-09-06 — PaperCut NG/MF Flaws CVE-2026-81578 and CVE-2026-82078 Exploited in Pre-Auth RCE Chain Targeting U.S. and European Education Sector: What changed No field escalations: severity remains CRITICAL, exploitability ACTIVE, CVSS 9.4 in both records. The campaign has since matured — CISA added both CVEs to the KEV catalog (31 Aug), a third emergency patch superseded the first t
- 2026-08-30 — PaperCut NG/MF Authentication-Bypass-to-RCE Chain (CVE-2026-81578, CVE-2026-82078) Under Active Exploitation: What changed No escalation — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (9.4), and attribution_confidence (LOW) in the newer report all match the existing record already. New indicators (2) 2 new raw base64-encoded
- 2026-08-29 — PaperCut NG/MF Chained Authentication Bypass and Unsafe Dynamic Class Loading Flaws (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild: What changed No whitelisted field escalations — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) were already at maximum. The material development is that Emergency Patch Release 2, previously treated as the fix, has itself
- 2026-08-29 — PaperCut NG/MF Zero-Day (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild, Emergency Patch Released: What changed No severity/exploitability/status/CVSS change (already CRITICAL/ACTIVE/9.4/LOW in the existing record). Incremental corroborating detail only. New indicators (4) Named researchers behind the Release 1 patch-bypass discovery (Ja
- 2026-08-29 — PaperCut NG/MF Pre-Auth RCE Chain (CVE-2026-81578, CVE-2026-82078) Actively Exploited: What changed No change to severity, exploitability, status, or CVSS (remains CRITICAL / ACTIVE / 9.4). New technical depth on the CVE-2026-82078 mechanism: the malicious JDBC/H2 URL abuses Derby's foreignViews feature to run an inline INIT
- 2026-08-28 — PaperCut NG/MF Zero-Day Vulnerabilities (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild — Second Emergency Patch Released: What changed No field escalation — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) were already at their maximum values in the existing record and remain unchanged. New indicators (8) Added the SYSTEM-level PoC process (ch
- 2026-08-28 — Attackers Chain Two PaperCut Flaws (CVE-2026-81578, CVE-2026-82078) for Unauthenticated Remote Code Execution: What changed No severity/exploitability/status escalation — both reports agree CRITICAL/ACTIVE/CVSS 9.4. The update adds mechanism-level technical depth: CVE-2026-81578 is now understood as an Apache Tapestry 'complex direct' component-conf
Sources cited for PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 &
- PaperCut warns of hackers using printer management vulnerabilities
- URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
- PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
- PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
- PaperCut NG/MF vulnerabilities exploited in zero-day attacks
- PaperCut NG/MF Vulnerability Actively Exploited in Attack - All Versions Impacted
- NVD - CVE-2026-82078
- NVD - CVE-2026-81578
Detection coverage for TL-2026-2184
As of 2026-10-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2184 across Splunk SPL, Microsoft KQL and Sigma, covering 105 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.