# PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation

> PaperCut disclosed and emergency-patched two chained vulnerabilities in PaperCut NG/MF print management software: CVE-2026-81578, an unauthenticated web-management-interface access-control bypass (CVSS 8.8), and CVE-2026-82078, an unsafe dynamic class-loading flaw enabling arbitrary Java bytecode execution (CVSS 9.4). Huntress confirmed pre-authentication RCE exploitation against at least two customer environments, and PaperCut's initial 27 Aug 2026 patch proved insufficient, requiring a same-week Release 2 hardening build co-developed with Huntress and watchTowr.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-10-09T22:56:45.749Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2184
- **ID:** TL-2026-2184
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 105 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-82078, CVE-2026-81578, CVE-2021-42278, CVE-2021-42287, CVE-2026-82077

## Description

PaperCut Software issued an URGENT, out-of-cycle security bulletin on 27 August 2026 (2:10 a.m. AEST) disclosing two vulnerabilities in PaperCut NG and PaperCut MF, its print management platform deployed across universities, corporations, and government organizations and compatible with Canon, Epson, Xerox, Brother, and other printer brands.

CVE-2026-81578 (CVSS 8.8, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N) is an improper access control flaw in the web management interface: under specific conditions, a crafted request can reference one page for rendering while another page's component or action executes on the backend, allowing unauthenticated remote requests to trigger administrative actions before access-validation checks complete. This lets an unauthenticated attacker modify system configuration, including database connection settings.

CVE-2026-82078 (CVSS 9.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, CWE-470) is an unsafe dynamic class-loading vulnerability in PaperCut's database connection utilities: the application loads JDBC database driver classes without validating them against an approved allow-list, so an attacker who can manipulate the JDBC driver configuration parameter can force PaperCut to load and execute arbitrary attacker-supplied Java bytecode.

Chained together, the two flaws produce a pre-authentication remote code execution path: CVE-2026-81578 lets an unauthenticated attacker reach and rewrite the JDBC connection configuration that would otherwise require high privilege, and CVE-2026-82078 turns that rewritten configuration into arbitrary code execution inside the pc-app.exe Application Server process. Huntress independently reproduced the full chain against a pre-patch build (PaperCut NG 25.0.11.75758) and documented two live customer compromises (26 and 27 August 2026) in which attackers delivered hex-encoded malicious Java .class files (observed as Udydn.class and Moo97.class) into PaperCut's server lib directory via an attacker-controlled SMB2 share carrying Apache Derby archives, then executed base64-encoded reconnaissance commands (whoami & ver, later expanded to whoami & ver & tasklist), wrote output to companion .out files, and deleted server.log, derby.log, and the output artifacts to erase evidence. Each observed compromise lasted under two minutes, consistent with automated or scripted probing rather than a sustained post-exploitation campaign; no persistence or lateral movement was documented in either incident.

A university customer's internal security team is credited with first identifying the suspicious activity that led to discovery. PaperCut's initial emergency patch (27 August, v25/v26 branches, Windows/Linux/macOS) proved insufficient; a revised Emergency Patch Release 2 with additional hardening was issued the next day (28 August) after further work with Huntress and watchTowr, and PaperCut urged all customers to install Release 2 even if Release 1 was already applied. As of 28 August 2026, a patch for the older v24 branch remained in development. PaperCut has prior history of mass-exploited vulnerabilities: CVE-2023-27350/CVE-2023-27351 were exploited by the Bl00dy and Clop ransomware operations and by an Iranian state-backed actor against critical infrastructure in 2023, raising concern about campaign-scale escalation of this new chain. As of this writing, neither CVE-2026-82078 nor CVE-2026-81578 had yet appeared in the CISA Known Exploited Vulnerabilities catalog.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1057 Process Discovery
- T1070.004 Indicator Removal: File Deletion
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1587.001 Develop Capabilities: Malware
- T1588.005 Obtain Capabilities: Exploits
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1211 Exploitation for Defense Evasion
- T1068 Exploitation for Privilege Escalation
- T1620 Reflective Code Loading
- T1083 File and Directory Discovery
- T1059 Command and Scripting Interpreter: PowerShell
- T1136 Create Account: Local Account
- T1543 Create or Modify System Process: Windows Service
- T1003 OS Credential Dumping: Security Account Manager
- T1552 Unsecured Credentials: Credentials In Files
- T1087 Account Discovery: Local Account
- T1087 Account Discovery: Domain Account
- T1071 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1595.002 Active Scanning
- T1588.002 Obtain Capabilities: Tool
- T1136.002 Create Account: Domain Account
- T1078.002 Valid Accounts: Domain Accounts
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1572 Protocol Tunneling
- T1219 Remote Access Software
- T1505.003 Server Software Component: Web Shell
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1036 Masquerading
- T1112 Modify Registry

## Sources

- [PaperCut warns of hackers using printer management vulnerabilities](https://therecord.media/papercut-warns-of-hackers-using-printer-management-vulnerabilities)
- [URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)
- [PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE](https://www.huntress.com/blog/papercut-actively-exploited)
- [PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions](https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html)
- [PaperCut NG/MF vulnerabilities exploited in zero-day attacks](https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/)
- [PaperCut NG/MF Vulnerability Actively Exploited in Attack - All Versions Impacted](https://cybersecuritynews.com/papercut-ng-mf-vulnerability-actively-exploited/)
- [NVD - CVE-2026-82078](https://nvd.nist.gov/vuln/detail/CVE-2026-82078)
- [NVD - CVE-2026-81578](https://nvd.nist.gov/vuln/detail/CVE-2026-81578)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2184