CVE-2026-81578

What is PaperCut NG/MF?

PaperCut NG and MF are print-management servers used across education, healthcare, and enterprise to control printing fleets. The Application Server is a Java web application, often internet-exposed for remote printing, with a track record of mass exploitation — the 2023 PaperCut flaws were leveraged by Cl0p and Bl00dy ransomware operations.

Overview

CVE-2026-81578 is a missing-authentication flaw (CWE-305, CVSS 9.8) in the PaperCut NG/MF web management interface: under specific conditions the server processes administrative requests before access-validation checks complete, letting an unauthenticated remote attacker reach admin functions and modify system configuration. It is the entry point of the exploited zero-day chain — attackers used it to change configuration unauthenticated, then either triggered the unsafe-reflection flaw CVE-2026-82078 for pre-auth RCE or abused the config access directly for data theft. Both CVEs were exploited in the wild before PaperCut's 2026-08-27 advisory and added to KEV on 2026-08-31.

Affected Versions

PaperCut issued three emergency patches in rapid succession after the first fix was bypassed — confirm you are on the latest build listed in the 27-Aug bulletin.

Technical Details

The web management interface contains a race in its request handling: administrative requests can be processed before the access-validation logic finishes, so an unauthenticated remote attacker can invoke admin functionality — notably modification of system configuration settings such as the database driver class and the external user-lookup configuration. No credentials, no user interaction, low complexity, single-request class of attack.

Those two writable settings are exactly what makes the chain work: pointing the DB driver setting at an attacker-chosen class triggers CVE-2026-82078's unsafe reflection (RCE), while rewriting the external user-lookup config redirects PaperCut's directory queries for data theft. NVD scores this 9.8; some press coverage cited a vendor score of 8.8.

Discovery

A zero-day: exploitation in the wild came first, prompting PaperCut's urgent 2026-08-27 bulletin. watchTowr and Huntress contributed the post-disclosure bypass research that forced the follow-up emergency patches.

Exploitation Context

Same campaign as CVE-2026-82078: Huntress observed intrusions in two customer environments (recon, hex-encoded Java payloads); Defused honeypots recorded exploitation from 2026-08-29 UTC focused on data theft — hijacking the external user-lookup mechanism and dumping tables from the embedded Derby database. 800+ PaperCut servers are internet-exposed per Shadowserver. No actor has been named, though this product's flaws have historically been picked up quickly by ransomware crews.

Remediation

1. Apply PaperCut's latest emergency patch (Emergency Patch Release 2 or newer) for v24/v25/v26; upgrade older versions. Federal deadline: 2026-09-14.
2. Firewall the web interfaces (default 9191/9192) to trusted networks — this flaw is unauthenticated and internet-facing servers were the ones hit.
3. Audit configuration for tampering: database driver settings, external user-lookup configuration, admin accounts, and any config change since late August 2026 you can't attribute.
4. Hunt for follow-on activity: hex-encoded Java files, Derby database dumps, unexpected outbound connections from the PaperCut host.
5. If tampering is confirmed, treat directory data synced into PaperCut as exposed, rotate the server's service credentials, and remediate together with CVE-2026-82078 — the chain partner is fixed by the same patch.