Press play to start listening
On August 27, 2026, print management software provider PaperCut issued an urgent security warning after confirming attacks exploiting flaws in PaperCut NG and PaperCut MF. The company later assigned two CVEs to the attack chain and said its advisory applies to all versions of both products.
PaperCut NG is self-hosted software for monitoring and controlling printing. PaperCut MF adds deeper integration with multifunction devices, including secure print release and tracking for copying, scanning and faxing. Both products use the PaperCut Application Server targeted in the reported attacks.
PaperCut said information supplied by a university customer’s security and digital forensics teams helped it reproduce the vulnerability. Huntress separately found exploitation in two customer environments, where the observed commands focused on identifying accounts, operating systems and running processes. Huntress and watchTowr later contributed analysis used to strengthen the patches.
“This situation is rapidly evolving, and watchTowr continues to work directly with PaperCut to share any insights,” watchTowr said in a post shared with Hackread.com.
Chaining Flaws for Remote Code Execution
PaperCut has assigned two CVE IDs to the vulnerabilities in the attack chain.
CVE-2026-81578 is an authentication bypass with a CVSS score of 8.8. Under specific conditions, unauthenticated requests targeting administrative functions can trigger backend actions before access checks finish, allowing an attacker to modify certain system settings.
CVE-2026-82078 is an unsafe dynamic class-loading vulnerability with a CVSS score of 9.4. PaperCut loads database driver classes from configurable names without checking them against an approved list. An attacker who can modify those settings can execute arbitrary Java bytecode residing on the application classpath under the PaperCut server process.
Chaining the flaws enables pre-authentication remote code execution (RCE) on the PaperCut Application Server. Huntress reproduced the attack against PaperCut NG 25.0.11.75758 and showed a charmap.exe process running as SYSTEM under the pc-app.exe process.
Attack Activity and Updated Fix
Huntress recovered a hex-encoded Java class written to the server as Udydn.class, with another copy found as Moo97.class. After decompiling the code with Fernflower, Huntress found that it could profile Windows and Linux systems, list files and write results to Udydn.out. It then deleted the output, PaperCut’s server.log, the Derby database log and the class file itself.
After PaperCut released its first emergency patch, watchTowr said it reproduced the vulnerabilities, found multiple patch bypasses and identified another authentication bypass. PaperCut subsequently released Emergency Patch Release 2 on August 28 with additional hardening developed alongside Huntress and watchTowr.
On August 29, PaperCut said it was investigating reports that SAML and external database Card/ID lookup were not working as expected after Release 2. Customers using external Card/ID lookups may need to add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server.
PaperCut recommends Emergency Patch Release 2 for versions 24, 25 and 26, including systems that received the original emergency patch. Customers using version 23 or earlier should upgrade to the latest release. Administrators should immediately restrict public access to Application Server web interfaces and update Site Servers and secondary print servers. Print Deploy and Mobility Print are not affected.
PaperCut advises administrators to check for suspicious child processes or other activity involving pc-app.exe, missing or truncated server.log files and these entries:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
The company warns that the absence of these indicators does not confirm that a server was unaffected.
Expert Commentary
Jake Knott, Head of Threat Intelligence at watchTowr, shared the following comments with Hackread.com on the ongoing PaperCut exploitation.
“PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated.”
PaperCut faced widespread exploitation in 2023 involving CVE-2023-27350, which attackers used to obtain unauthenticated administrative access and execute code.
Hackread.com reported that Iranian groups Mint Sandstorm and Mango Sandstorm exploited unpatched servers, while attackers associated with Cl0p and LockBit ransomware also used the vulnerability.
Knott urged organizations with vulnerable internet-facing PaperCut systems to remove public access and act quickly:
“This is not a vulnerability you want to wait on change control, CVE assignment, or a ransom note to hit your desktop before applying a patch and removing public internet access.”
