PaperCut NG/MF CVE-2026-81578: Patch Now, Exploited in Wild

Print management software PaperCut NG / PaperCut MF is under active attack through a chain of two vulnerabilities. PaperCut Software published an urgent security bulletin on 2026-08-27, and CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 2026-08-31.

This article covers only what could be verified against the vendor bulletin, NVD, JVN and CISA as of 2026-09-01. The vendor advisory is still being updated.

The short version: if your PaperCut Application Server admin interface is reachable from the public internet, restrict access before you patch. That is the vendor's own first-priority instruction.

Immediate action required

• ✓Check whether the Application Server web admin interface is reachable from the internet. If it is, restrict it to trusted IP addresses using firewall rules or network access controls. The vendor asks you to do this immediately, even if you have seen no suspicious activity
• ✓Apply Emergency Patch Release 3. Environments already running Release 1 or Release 2 still need it — the vendor states this explicitly in its FAQ
• ✓Update Site Servers and secondary/print servers to a patched version as well. Patching only the primary Application Server is not enough
• ✓If you run v23 or earlier, no emergency patch is available; the vendor's guidance is to upgrade to v24 or later
• ✓Review `server.log` for the indicators listed below. Treat a missing or unexpectedly truncated log as suspicious in itself
• ✓Only if you use an external database for card/ID number lookups, add `security.card-number-lookup.enabled=Y` to `server/security.properties` and restart the Application Server. If you do not use that feature, change nothing

Both scores above are the vendor's own CVSS v4.0 assessment (PaperCut Software). They differ from the NIST scores published on NVD.

• ▸CVE-2026-81578: vendor v4.0 8.8 / HIGH (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N`) / NIST v3.1 9.8 / CRITICAL
• ▸CVE-2026-82078: vendor v4.0 9.4 / CRITICAL (`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`) / NIST v3.1 9.1 / CRITICAL

Different CVSS versions produce different numbers, so neither set is wrong. This article uses the vendor's v4.0 for both, so the two CVEs can be compared on the same scale. Do not be surprised when NVD shows different figures.

That said, comparing scores is close to pointless here. These are being exploited right now, which puts them at the top of the queue regardless.

How the two flaws chain together

On their own, each flaw looks limited. Chained, they give arbitrary code execution under the PaperCut server process.

CVE-2026-81578 (authentication bypass) is a flaw in the web management interface. Per the vendor, under specific conditions unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes. That lets an attacker who has not logged in modify certain system configurations.

CVE-2026-82078 (unsafe dynamic class loading) is a flaw in the database connection utilities. PaperCut instantiates database driver classes based on configurable driver names, and those names were not validated against an allowlist of approved drivers. An attacker who can change configuration can therefore execute arbitrary Java bytecode residing on the application classpath, under the security context of the PaperCut server process.

The first flaw hands over the key to the configuration; the second turns that configuration into execution. CISA notes on both entries that each can be chained with the other.

In the activity the vendor has published, `pc-app.exe` (the PaperCut application server process) spawns `cmd.exe` as a child process and runs `whoami` and `ver`. In some environments endpoint protection stopped it there and isolated the machine. Where it was not stopped, the activity progressed through domain controller listing and enumeration of logged-on users to installing remote access tooling — a SimpleHelp agent and AnyDesk.

Rapid7's Metasploit module (Pull Request #21842, opened 2026-08-28) shows a worked example obtaining a SYSTEM-level session against PaperCut MF on Windows Server 2025. NVD lists that pull request as a reference on both CVE entries, so you can reach it from the NVD pages linked below. Assume the technique is public.

Version numbers will not tell you whether you are safe

This is the easiest thing to get wrong here. The affected range is recorded three different ways depending on which source you read.

- The CVE record PaperCut itself publishes as the CNA (CVE.org, updated 2026-09-01): both CVEs are recorded as affecting everything below 24.1.10 / 25.0.13 / 26.0.5
- NVD and JVN: below 24.1.9 / 25.0.2 up to but not including 25.0.12 / 26.0.2 up to but not including 26.0.4 — one patch increment lower than the CNA record
- PaperCut's security bulletin (the KB page): states the advisory applies to all versions of PaperCut NG and PaperCut MF, with no version boundary at all

The 24.1.10 / 25.0.13 / 26.0.5 numbers in the CNA record correspond to the QA'd maintenance release that was still in progress as of September 1. The vendor's FAQ states plainly that the emergency patch is not an official release; what ships today is an Emergency Patch identified by build number.

So no version string currently tells you whether you are safe. The Metasploit example noted earlier succeeds against `PaperCut MF 26.0.4 (Build 76494)` — reading only the NVD range and concluding that 26.0.4 is fixed would be wrong.

Check the build number, not the version number. Emergency Patch Release 3 builds are:

• ▸PaperCut MF: v26 = Build 76531 / v25 = Build 76532 / v24 = Build 76534
• ▸PaperCut NG: v26 = Build 76530 / v25 = Build 76533 / v24 = Build 76535
• ▸SHA256 checksums are published alongside each Windows (exe), Linux (sh) and macOS (dmg) download — verify them after downloading
• ▸Install it with the standard upgrade procedure. You do not need to apply earlier patches first; Release 3 is cumulative

Patching once is not enough

Three generations of emergency patch shipped between August 28 and September 1 (all times as published by the vendor, AEST).

• ▸Release 1 (Aug 28, 02:10): published for v25 and v26
• ▸Release 2 (Aug 28, 20:42): additional hardening developed with Huntress and watchTowr. The v24 build followed at 22:08 the same day
• ▸Release 3 (Sep 1, 18:22): fixes two regressions — broken SAML login flows and legacy Microsoft SQL Server driver support — and adds further hardening that closes attack vectors the vendor observed being exploited in the wild

The Metasploit module description states that it bypasses the vendor's emergency patch v1, and that v2 was verified to remediate the exploit. In other words, an environment still on Release 1 is exploitable despite having been patched.

And since the vendor describes Release 3 as closing additional observed attack vectors, environments on Release 2 need to move as well.

Checking whether you were compromised

These are the indicators the vendor has published. Their absence is not proof that a system is clean — the vendor adds the same caveat, because an attacker may clean these files up as the intrusion progresses.

• ▸`server.log` files that are missing, unexpectedly truncated, or deleted
• ▸`ERROR No suitable driver found for jdbc:no:x` in `server.log`
• ▸`ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST` in `server.log`
• ▸`DB URL: jdbc:derby:memory:pwn;create=true` in `server.log`
• ▸A roughly five-character random-named `.class` file under `<install>\server\lib\`
• ▸Roughly five-character random-named `.cmd` / `.out` files under `<install>\server\data\content\`
• ▸`pc-app.exe` (or `pc-app` on Linux) spawning shell processes such as `cmd.exe`
• ▸A Windows service named "Remote Access Service" running as LocalSystem with auto-start (a SimpleHelp agent)
• ▸An unexpected AnyDesk installation
• ▸Intrusion-detection, endpoint-security or network-monitoring alerts involving the PaperCut Application Server

If you suspect compromise, the vendor recommends securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Activate your organization's incident response procedures alongside that.

Patching does not remove remote access tooling that has already been installed. Keep those two things separate in your response.

What is not affected

• ▸PaperCut Hive and PaperCut Pocket: this bulletin and the vulnerabilities do not apply to them
• ▸Mobility Print and Print Deploy server components: unaffected and do not need updating. Mobility Print runs on a separate architecture, so its ports do not need to be closed
• ▸Client software (User Client, Print Deploy client, Mobility Print installer): unaffected and does not require an update

What to take away from this

A version number is not an answer to "is this fixed?" During an active incident, patches ship ahead of the normal release process, so you have to track build numbers and patch generations rather than versions. NVD and JVN version ranges are convenient, but the vendor's own wording wins.

"We patched" is rarely a one-time statement. Three patch generations shipped in five days here, and the first one was bypassed. Treat a live advisory page as something you re-read, not something you read once.

And keeping the admin interface off the public internet is the first line of defence. This whole chain depends on reaching that interface. PaperCut has been here before: CVE-2023-27350 and CVE-2023-27351 are both in the CISA KEV catalog, flagged as known to be used in ransomware campaigns. When the same product is targeted repeatedly, reducing the exposed surface is the more reliable move.