Full Report
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's
Analysis Summary
# Vulnerability: PaperCut NG/MF Authentication Bypass and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-81578 (Auth Bypass) and CVE-2026-82078 (RCE)
- **CVSS Score:** 9.4 (Critical) for CVE-2026-82078; 8.8 (High) for CVE-2026-81578
- **CWE:** CWE-285 (Improper Authorization) and CWE-494 (Download of Code Without Integrity Check / Unsafe Dynamic Class Loading)
## Affected Systems
- **Products:** PaperCut NG and PaperCut MF
- **Versions:** All versions prior to the emergency hardening patches released in August 2026.
- **Configurations:** Systems with the Web Management Interface exposed to unauthenticated users (especially those with internet-facing exposure).
## Vulnerability Description
This security issue involves a "chain" of two distinct flaws:
1. **Authentication Bypass (CVE-2026-81578):** An improper access control flaw in the web interface where specifically crafted requests allow unauthenticated attackers to trigger administrative backend actions before access validation is completed.
2. **Remote Code Execution (CVE-2026-82078):** Once administrative access is gained (via the bypass), an attacker can exploit the database connection utilities. The application instantiates database driver classes based on user-configurable names without validating them against an allowlist, permitting the loading of malicious Java classes.
## Exploitation
- **Status:** **Exploited in the wild.** Active exploitation has been observed by security researchers (Huntress, watchTowr).
- **Complexity:** Low (Attacker can automate the chain).
- **Attack Vector:** Network (Remote)
- **PoC Availability:** Functional exploits are being utilized by threat actors; technical walkthroughs of the bypass logic are publicly available from researchers.
## Impact
- **Confidentiality:** High (Total access to application data and server files).
- **Integrity:** High (Ability to modify server configuration and execute arbitrary Java code).
- **Availability:** High (Ability to delete logs and potentially disrupt print services).
## Remediation
### Patches
- Apply the **second emergency patch** released by PaperCut (August 27, 2026). This update includes the initial fixes plus "additional hardening" to address patch bypasses.
- Users should consult the PaperCut Security Bulletin (link below) for the specific version numbers applicable to their license.
### Workarounds
- **Network Segmentation:** Immediately remove PaperCut Application Server web access from the public internet.
- **Access Control:** Restrict access to the management interface to trusted IP addresses only.
- **VPN:** Place the administrative path behind a VPN or identity-aware proxy.
## Detection
### Indicators of Compromise
- **Files:** Look for a file named `Udydn.out` located in the `/data/content/` directory relative to the PaperCut installation.
- **Commands:** Presence of Base64-encoded commands in logs or process execution history, specifically those decoding to `whoami & ver`, `whoami & ver & tasklist`, or directory listing commands.
- **Log Gaps:** Unexpected deletion of `server.log` or `/data/internal/derby.log`.
### Detection methods and tools
- Monitor for unusual Java process child activities (e.g., `java.exe` spawning `cmd.exe` or `bash`).
- Inspect web server logs for requests that appear to target administrative components while lacking valid session tokens.
## References
- **Vendor Advisory:** hxxps[://]www[.]papercut[.]com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- **Huntress Research:** hxxps[://]www[.]huntress[.]com/blog/papercut-actively-exploited
- **News Coverage:** hxxps[://]thehackernews[.]com/2026/08/attackers-chain-two-papercut-flaws-to[.]html