Full Report
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. [...]
Analysis Summary
# Vulnerability: PaperCut NG/MF Authentication Bypass and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-81578 (Auth Bypass) and CVE-2026-82078 (RCE)
- **CVSS Score:** 8.8 (High) and 9.4 (Critical)
- **CWE:** Improper Access Control / Unsafe Dynamic Class Loading
## Affected Systems
- **Products:** PaperCut NG and PaperCut MF
- **Versions:** 24.x, 25.x, and 26.x
- **Configurations:** Systems with web management interfaces exposed to the network. Site Servers and secondary/print servers are also affected.
## Vulnerability Description
These two vulnerabilities are frequently chained to achieve full system compromise:
1. **CVE-2026-81578:** An authentication bypass in the web management interface. Due to a race condition or improper validation logic, unauthenticated remote requests targeting administrative functions can trigger backend actions before access checks are finalized.
2. **CVE-2026-82078:** An unsafe dynamic class-loading flaw in the database connection utilities. The application fails to validate driver names against an allowlist, permitting an attacker to manipulate configuration parameters to execute arbitrary Java bytecode under the security context of the PaperCut server process.
## Exploitation
- **Status:** Exploited in the wild (Zero-day attacks reported); PoC has been reproduced by security researchers (watchTowr/Huntress).
- **Complexity:** Low (Initial patches were easily bypassed).
- **Attack Vector:** Network (Unauthenticated remote access).
## Impact
- **Confidentiality:** High (Full access to server data and print logs).
- **Integrity:** High (Execution of arbitrary code and system modification).
- **Availability:** High (Potential for ransomware or system shutdown).
## Remediation
### Patches
PaperCut has released **Emergency Patch Release 2**. Users must apply this second update even if the first emergency patch was already installed.
- **PaperCut NG/MF v24, v25, and v26:** Available for Windows, Linux, and macOS.
- **Legacy Versions (v23 or earlier):** No patch available; customers must upgrade to a supported, patched version.
### Workarounds
- **Network Segmentation:** Restrict access to the PaperCut web management interface to trusted IP addresses only using firewalls or ACLs.
- **Component Updates:** Ensure Site Servers and secondary servers are updated alongside the main application server.
## Detection
### Indicators of Compromise
- **Log Errors:** Monitor `server.log` for the following specific strings:
- `ERROR No suitable driver found for jdbc:no:x`
- `ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST`
- **File Integrity:** Look for missing or truncated `server.log` files (indicative of log cleaning).
- **Process Monitoring:** Audit suspicious child processes or network activity originating from `pc-app.exe`.
## References
- **Vendor Advisory:** [https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)
- **BleepingComputer Report:** [https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/](https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/)