PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation — Threadlinqs Intelligence
As of 2026-08-30, PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 38 indicators of compromise.
Threat ID: TL-2026-2184 · Severity: CRITICAL · CVSS: 9.4 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-30 · 6 updates · revalidated 6× · latest source
PaperCut disclosed and emergency-patched two chained vulnerabilities in PaperCut NG/MF print management software: CVE-2026-81578, an unauthenticated web-management-interface access-control bypass
PaperCut Software issued an URGENT, out-of-cycle security bulletin on 27 August 2026 (2:10 a.m. AEST) disclosing two vulnerabilities in PaperCut NG and PaperCut MF, its print management platform deployed across universities, corporations, and government organizations and compatible with Canon, Epson, Xerox, Brother, and other printer brands.
CVE-2026-81578 (CVSS 8.8, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N) is an improper access control flaw in the web management interface: under specific conditions, a crafted request can reference one page for rendering while another page's component or action executes on the backend, allowing unauthenticated remote requests to trigger administrative actions before access-validation checks complete. This lets an unauthenticated attacker modify system configuration, including database connection settings.
CVE-2026-82078 (CVSS 9.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, CWE-470) is an unsafe dynamic class-loading vulnerability in PaperCut's database connection utilities: the application loads JDBC database driver classes without validating them against an approved allow-list, so an attacker who can manipulate the JDBC driver configuration parameter can force PaperCut to load and execute arbitrary attacker-supplied Java bytecode.
Chained together, the two flaws produce a pre-authentication remote code execution path: CVE-2026-81578 lets an unauthenticated attacker reach and rewrite the JDBC connection configuration that would otherwise require high privilege, and CVE-2026-82078 turns that rewritten configuration into arbitrary code execution inside the pc-app.exe Application Server process. Huntress independently reproduced the full chain against a pre-patch build (PaperCut NG 25.0.11.75758) and documented two live customer compromises (26 and 27 August 2026) in which attackers delivered hex-encoded malicious Java .class files (observed as Udydn.class and Moo97.class) into PaperCut's server lib directory via an attacker-controlled SMB2 share carrying Apache Derby archives, then executed base64-encoded reconnaissance commands (whoami & ver, later expanded to whoami & ver & tasklist), wrote output to companion .out files, and deleted server.log, derby.log, and the output artifacts to erase evidence. Each observed compromise lasted under two minutes, consistent with automated or scripted probing rather than a sustained post-exploitation campaign; no persistence or lateral movement was documented in either incident.
A university customer's internal security team is credited with first identifying the suspicious activity that led to discovery. PaperCut's initial emergency patch (27 August, v25/v26 branches, Windows/Linux/macOS) proved insufficient; a revised Emergency Patch Release 2 with additional hardening was issued the next day (28 August) after further work with Huntress and watchTowr, and PaperCut urged all customers to install Release 2 even if Release 1 was already applied. As of 28 August 2026, a patch for the older v24 branch remained in development. PaperCut has prior history of mass-exploited vulnerabilities: CVE-2023-27350/CVE-2023-27351 were exploited by the Bl00dy and Clop ransomware operations and by an Iranian state-backed actor against critical infrastructure in 2023, raising concern about campaign-scale escalation of this new chain. As of this writing, neither CVE-2026-82078 nor CVE-2026-81578 had yet appeared in the CISA Known Exploited Vulnerabilities catalog.
Weaknesses (CWE)
CWE-470, CWE-863, CWE-305
Target sectors: education, government administration, corporate, managed-print-services
Timeline
- Prior PaperCut critical flaw CVE-2023-27350 was exploited by Clop ransomware, LockBit, and Iranian state-linked actors for initial network access, establishing PaperCut as a recurring high-value target.
- Huntress observes the first confirmed customer exploitation incident: a base64-encoded 'whoami & ver' reconnaissance command executed via a malicious Java class (Udydn.class) dropped into the PaperCut server lib directory.
- A second Huntress customer incident is observed: an expanded 'whoami & ver & tasklist' command executed via a second malicious class (Moo97.class), widening reconnaissance to process enumeration.
- A university customer's internal security team first identifies the suspicious activity that leads to discovery of the vulnerability chain.
- PaperCut publishes an URGENT out-of-cycle security bulletin at 2:10 a.m. AEST and releases emergency Release 1 builds for the v25 and v26 branches (Windows, Linux, macOS) addressing CVE-2026-82078 and CVE-2026-81578.
- Huntress independently reproduces the full pre-auth RCE chain against a pre-patch build, PaperCut NG 25.0.11.75758.
- Rapid7 publishes a technical blog post independently detailing the authentication-bypass-plus-dynamic-class-loading exploit chain and confirming active in-the-wild exploitation.
- PaperCut publicly states it is 'aware of confirmed customer incidents and is treating this matter with the highest priority,' noting the v24 branch patch remains in development.
- PaperCut releases a revised Emergency Patch Release 2 with additional hardening, developed with Huntress and watchTowr, after the original emergency patch proves insufficient; all customers are urged to install it even if Release 1 was already applied.
- The Record, Help Net Security, The Hacker News, and Cybersecurity News publish coverage confirming active exploitation and the two-stage emergency patch cycle.
- CVE-2026-81578 and CVE-2026-82078 are formally assigned to the access-control-bypass and dynamic-class-loading flaws respectively, after the vendor's initial advisory was published without CVE identifiers.
- watchTowr finds the first emergency patch is still bypassable by selecting the public Home page for display while invoking the administrative component, and identifies an additional authentication vulnerability, forcing PaperCut to ship the further-hardened Release 2.
Update History
- 2026-08-30 — PaperCut NG/MF Authentication-Bypass-to-RCE Chain (CVE-2026-81578, CVE-2026-82078) Under Active Exploitation: What changed No escalation — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (9.4), and attribution_confidence (LOW) in the newer report all match the existing record already. New indicators (2) 2 new raw base64-encoded
- 2026-08-29 — PaperCut NG/MF Chained Authentication Bypass and Unsafe Dynamic Class Loading Flaws (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild: What changed No whitelisted field escalations — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) were already at maximum. The material development is that Emergency Patch Release 2, previously treated as the fix, has itself
- 2026-08-29 — PaperCut NG/MF Zero-Day (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild, Emergency Patch Released: What changed No severity/exploitability/status/CVSS change (already CRITICAL/ACTIVE/9.4/LOW in the existing record). Incremental corroborating detail only. New indicators (4) Named researchers behind the Release 1 patch-bypass discovery (Ja
- 2026-08-29 — PaperCut NG/MF Pre-Auth RCE Chain (CVE-2026-81578, CVE-2026-82078) Actively Exploited: What changed No change to severity, exploitability, status, or CVSS (remains CRITICAL / ACTIVE / 9.4). New technical depth on the CVE-2026-82078 mechanism: the malicious JDBC/H2 URL abuses Derby's foreignViews feature to run an inline INIT
- 2026-08-28 — PaperCut NG/MF Zero-Day Vulnerabilities (CVE-2026-81578, CVE-2026-82078) Exploited in the Wild — Second Emergency Patch Released: What changed No field escalation — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) were already at their maximum values in the existing record and remain unchanged. New indicators (8) Added the SYSTEM-level PoC process (ch
- 2026-08-28 — Attackers Chain Two PaperCut Flaws (CVE-2026-81578, CVE-2026-82078) for Unauthenticated Remote Code Execution: What changed No severity/exploitability/status escalation — both reports agree CRITICAL/ACTIVE/CVSS 9.4. The update adds mechanism-level technical depth: CVE-2026-81578 is now understood as an Apache Tapestry 'complex direct' component-conf
Detections & IOCs
As of 2026-08-31, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 38 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-82078, CVE-2026-81578, T1190, T1059.003, T1033, T1082, T1057, T1070.004, T1027, T1140, T1587.001, T1588.005
