Full Report
Multiple vulnerabilities have been discovered in PaperCut products, the most severe of which could allow for remote code execution. PaperCut products are software tools used to track, control, secure, and manage printing, copying, and scanning across office and school printer networks. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.
Analysis Summary
# Morning News Roll-up 09/02/2026
## Overview
Critical security vulnerabilities have been identified in PaperCut software and Google Chrome, both of which could lead to remote code execution. Additionally, recent threat intelligence highlights active phishing campaigns utilizing dual Remote Monitoring and Management (RMM) tools and PowerShell RATs targeting government entities.
## Top Stories
### Multiple Vulnerabilities in PaperCut Products Could Allow for Remote Code Execution
- Summary: Two critical vulnerabilities (CVE-2026-81578 and CVE-2026-82078) in PaperCut NG and MF versions have been discovered. These flaws involve improper access control and unsafe dynamic class loading, allowing unauthenticated attackers to modify system configurations and execute arbitrary Java bytecode. PaperCut has confirmed these vulnerabilities are being exploited in the wild.
- Source: hxxps://www[.]papercut[.]com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
### Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
- Summary: Google has released updates to address multiple vulnerabilities in the Chrome browser. If successfully exploited, these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser, potentially leading to full system compromise depending on user privileges.
- Source: hxxps://www[.]cisecurity[.]org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-085
### Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs
- Summary: A new cyber campaign is targeting State, Local, Tribal, and Territorial (SLTT) government entities. The attackers use phishing emails to deploy dual RMM tools for persistence and a PowerShell-based Remote Access Trojan (RAT) to maintain control over infected systems and exfiltrate data.
- Source: hxxps://www[.]cisecurity[.]org/insights/blog/dual-rmm-phishing-powershell-rat-campaign-hits-sltts
---
# Main Topic
Critical Remote Code Execution (RCE) vulnerabilities in PaperCut NG and MF print management software (MS-ISAC Advisory 2026-086).
## Key Points
- Two primary vulnerabilities were identified: an access control bypass (CVE-2026-81578) and a dynamic class loading flaw (CVE-2026-82078).
- **CVE-2026-81578**: Allows unauthenticated remote requests to trigger administrative actions before access validation is complete.
- **CVE-2026-82078**: An unsafe dynamic class loading vulnerability in database utilities that allows the execution of Java bytecode.
- PaperCut reports that these vulnerabilities have already been **exploited in the wild**.
- Impact varies based on service account privileges; administrative accounts pose the highest risk for full system takeover.
## Threat Actors
- **Attribution**: Not specifically attributed to a named group in the report.
- **Motivations**: Likely include data theft, unauthorized system access, and network persistence.
- **Activity**: Active exploitation confirmed by the vendor.
## TTPs
- **Initial Access**: Exploit Public-Facing Application ([TA0001](https://learn.cisecurity.org/e/799323/tactics-TA0001-/4w2tv8/2750425471/h/XfVaoNjgzXvj2-kSl5CxC4wYXBABPArd5ZUm-bHpsCA) / [T1190](https://learn.cisecurity.org/e/799323/techniques-T1190-/4w2tvc/2750425471/h/XfVaoNjgzXvj2-kSl5CxC4wYXBABPArd5ZUm-bHpsCA)).
- **Execution**: Injection of Java bytecode via manipulated system configuration parameters and database driver instantiation.
- **Configuration Manipulation**: Bypassing access checks to modify backend settings.
## Affected Systems
- **PaperCut NG**: All versions.
- **PaperCut MF**: All versions.
- **Scope**: Large and medium government/business entities are considered HIGH risk.
## Mitigations
- **Immediate Patching**: Apply the latest security updates provided by PaperCut immediately.
- **Network Segmentation**: Isolate administrative computing resources from the primary enterprise network and restrict internet access for these tasks.
- **Principle of Least Privilege**: Configure service accounts with the minimum necessary rights to limit the impact of RCE.
- **Vulnerability Management**: Implement automated patch management (Safeguard 7.4) and conduct regular application penetration testing (Safeguard 16.13).
- **Public Exposure Reduction**: Ensure devices are not exposed to the public internet where possible.
## Conclusion
The vulnerabilities in PaperCut represent a significant risk due to confirmed active exploitation and the potential for full system compromise. Organizations using PaperCut NG or MF should prioritize patching these systems and auditing service account privileges to minimize the impact of any successful breach. Inbound traffic to print management servers should be restricted to authorized internal networks only.