Full Report
PaperCut NG and PaperCut MF are under active exploitation. Huntress reproduced a pre-auth RCE chain and shares urgent patching, exposure, and detection guidance.
Analysis Summary
# Vulnerability: PaperCut NG/MF Pre-Auth RCE Chain
## CVE Details
* **CVE ID:** CVE-2026-81578 (Improper Access Control) & CVE-2026-82078 (Unsafe Dynamic Class-Loading)
* **CVSS Score:** Not explicitly listed in text, but treated as **Critical** (Pre-Auth RCE)
* **CWE:**
* CVE-2026-81578: Improper Access Control
* CVE-2026-82078: Unsafe Dynamic Class-Loading
## Affected Systems
* **Products:** PaperCut NG and PaperCut MF
* **Versions:** All versions prior to the emergency releases are treated as potentially affected. Specific vulnerable versions mentioned: `25.0.11.75758` and earlier.
* **Configurations:** Application Servers exposed to the public internet or untrusted networks.
## Vulnerability Description
This is a multi-stage attack chain that achieves Remote Code Execution (RCE):
1. **CVE-2026-81578:** An improper access control flaw in the web management interface allows an unauthenticated attacker to modify system configurations.
2. **CVE-2026-82078:** By leveraging the modified configuration, an attacker exploits an unsafe dynamic class-loading vulnerability in the database connection utilities. This allows the execution of arbitrary Java bytecode within the context of the PaperCut Application Server process.
## Exploitation
* **Status:** **Exploited in the wild.** Huntress has confirmed customer incidents and reproduced the full chain.
* **Complexity:** Low (Chain enables pre-authentication RCE)
* **Attack Vector:** Network
## Impact
* **Confidentiality:** High (Full system discovery and data access possible)
* **Integrity:** High (Arbitrary code execution and system modification)
* **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
PaperCut has released **Release 3**, which is cumulative and supersedes previous emergency releases.
* **PaperCut NG/MF v25 (Windows):** `25.0.12.76497` (NG) / `25.0.12.76496` (MF)
* **Major Versions:** Emergency patches are available for versions 24, 25, and 26.
### Workarounds
* Immediately remove the PaperCut Application Server from public-facing internet connections.
* Restrict access to the management interface to trusted administrative networks only.
## Detection
* **Indicators of Compromise:** Look for Base64-encoded commands in process execution logs and unusual system discovery activity originating from the PaperCut service.
* **Detection Methods:** Monitor for unexpected outbound connections from the Application Server and audit configuration changes within the PaperCut web interface.
## References
* PaperCut Urgent Security Advisory: hxxps[://]www[.]papercut[.]com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
* Huntress Technical Analysis: hxxps[://]www[.]huntress[.]com/blog/papercut-actively-exploited
* PaperCut Incident Breakdown: hxxps[://]www[.]papercut[.]com/blog/news/behind-the-scenes-august-security-incident/