# PaperCut Vulnerability: Emergency Patches For CVE-2026-81578 and CVE-2026-82078 **Published on:** 2026-09-01T00:00:00.000Z **Author:** Packetlabs PaperCut has released emergency security patches for two vulnerabilities in its PaperCut NG and PaperCut MF print management software after confirming that threat actors are actively exploiting the flaws. The [PaperCut vulnerabilities](https://www.papercut.com/kb/Main/security-vulnerability-log/), tracked as CVE-2026-81578 and CVE-2026-82078, can be chained together to enable remote code execution (RCE) without authentication on vulnerable PaperCut Application Servers. The situation has developed rapidly. PaperCut initially issued an emergency patch after discovering active exploitation, but security researchers subsequently identified bypasses in the initial remediation. PaperCut then released a second emergency patch containing additional hardening. As of August 31st, 2026, the [Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en) says both vulnerabilities are being exploited in the wild and reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities (KEV) catalog. For organizations using PaperCut NG or MF, this should be treated as an urgent vulnerability-management and incident-response issue. ## What is the PaperCut Vulnerability? The current PaperCut security incident involves two separate vulnerabilities affecting PaperCut NG and PaperCut MF: * **CVE-2026-81578:** Authentication bypass vulnerability with a CVSS 4.0 score of 8.8. * **CVE-2026-82078:** Unsafe dynamic class-loading vulnerability with a CVSS 4.0 score of 9.4. PaperCut disclosed the vulnerabilities on August 27 after confirming customer incidents and active exploitation. The company has described the investigation as ongoing. The vulnerabilities are particularly dangerous because they can be chained together: [CVE-2026-81578](https://nvd.nist.gov/vuln/detail/cve-2026-81578) can allow an unauthenticated attacker to modify certain system configurations. [CVE-2026-82078](cve.org/CVERecord?id=CVE-2026-82078) can then potentially be used to execute arbitrary Java code under the security context of the PaperCut server process. Together, the vulnerabilities can provide an attacker with a path to unauthenticated remote code execution. That makes an internet-facing PaperCut Application Server a potentially attractive target for threat actors. ## CVE-2026-81578: PaperCut Authentication Bypass CVE-2026-81578 is an improper access-control vulnerability in the web management interface of PaperCut NG and PaperCut MF. The vulnerability has a CVSS 4.0 score of 8.8, placing it in the high-severity category. Under specific circumstances, [unauthenticated remote requests](https://www.packetlabs.net/posts/choosing-the-right-extensible-authentication-protocol/) targeting administrative functionality can trigger backend actions before the application's access-validation process is complete. This can allow an unauthenticated attacker to modify certain system configurations. An authentication bypass is particularly concerning because it can undermine an application's normal security boundary. In this case, however, the vulnerability becomes even more serious when combined with the second PaperCut vulnerability. ## CVE-2026-82078: Critical PaperCut Remote Code Execution Vulnerability CVE-2026-82078 is an unsafe dynamic class-loading vulnerability in the database connection utilities of PaperCut NG and PaperCut MF. It has a CVSS 4.0 score of 9.4, making it a critical-severity vulnerability. The vulnerability results from the application instantiating database driver classes based on configurable driver names without sufficiently restricting those names to an approved allowlist. If a threat actor can manipulate relevant system configuration parameters, the flaw can enable arbitrary Java bytecode located on the application classpath to execute under the security context of the PaperCut server process. On its own, CVE-2026-82078 requires access to the relevant configuration functionality. When paired with CVE-2026-81578, however, an attacker can potentially obtain that access without authenticating. This is why security researchers have described the vulnerabilities as an **RCE chain**. ## How the PaperCut CVEs Can Be Chained The two PaperCut CVEs demonstrate why security teams should assess vulnerabilities based not only on their individual severity scores but also on how they can interact. The attack chain broadly involves: 1. An attacker reaches a vulnerable PaperCut Application Server. 2. CVE-2026-81578 is used to bypass authentication controls. 3. The attacker modifies relevant system configuration. 4. CVE-2026-82078 is used to trigger unsafe dynamic class loading. 5. The attacker can potentially execute arbitrary Java code on the PaperCut server. This means the primary concern is not simply unauthorized access to the PaperCut management interface. The vulnerability chain can potentially progress to [arbitrary code execution on the underlying server](https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/). For organizations with internet-facing PaperCut infrastructure, that distinction significantly increases the urgency of remediation. ## PaperCut Releases a Second Emergency Patch PaperCut's response has evolved as researchers have learned more about the vulnerabilities. The company initially released an emergency patch after confirming exploitation. However, researchers subsequently identified ways to bypass portions of the initial remediation. PaperCut then published Emergency Patch Release 2 on August 28. The company says the second release includes additional hardening. Security researchers at watchTowr identified [multiple patch bypasses](https://www.packetlabs.net/posts/remote-work-security-and-patching/) and an additional authentication-bypass issue during their investigation, contributing to the need for additional remediation. This is an important distinction for organizations that responded to the original advisory. Installing the first emergency patch is not sufficient. Organizations should verify that they have implemented the latest Emergency Patch Release 2 applicable to their PaperCut environment. ## Which PaperCut Versions Are Affected? PaperCut says the security advisory applies to PaperCut NG and PaperCut MF. The Canadian Centre for Cyber Security currently identifies versions prior to Emergency Patch Release 2 for major versions 24, 25, and 26 as affected. Organizations should therefore inventory their PaperCut installations and confirm both the product and exact version. Affected organizations should not assume that being on a recent major version automatically provides protection. The relevant question is whether the installation has received the emergency remediation that addresses these specific vulnerabilities. ## Are PaperCut Vulnerabilities Being Actively Exploited? Yes. PaperCut has confirmed customer incidents and active exploitation involving the vulnerabilities. Huntress reported exploitation beginning as early as August 26 and identified attacks against at least two customer environments. Researchers observed reconnaissance activity following exploitation. The Canadian Centre for Cyber Security has also confirmed that open-source reporting indicates the vulnerabilities are being exploited in the wild. On August 31st, it reported that CISA had added both CVEs to its Known Exploited Vulnerabilities catalog. The addition to the KEV catalog is particularly significant for government and security teams that use KEV listings to prioritize remediation. Organizations should therefore treat these vulnerabilities as an active exploitation threat rather than a theoretical vulnerability. ## Why Internet-Facing PaperCut Servers Are at Risk PaperCut has specifically urged organizations to restrict access to PaperCut Application Servers from the public internet. The company recommends limiting access to trusted IP addresses. This is an important mitigation because an internet-facing Application Server is directly reachable by potential attackers conducting automated scanning and vulnerability discovery. PaperCut deployments can also have access to important internal resources. A compromised print-management server could potentially become an initial foothold from which attackers conduct reconnaissance, establish persistence or attempt lateral movement. Print infrastructure may not traditionally be viewed as a high-priority cybersecurity asset. However, enterprise applications frequently have extensive connectivity and permissions within corporate networks. The PaperCut incident illustrates why organizations need to consider the security implications of every internet-facing application, including systems that support [seemingly routine business functions](https://www.packetlabs.net/services/attack-surface-penetration-testing/). ## What Are the Indicators of PaperCut Exploitation? Organizations that operate PaperCut NG or MF should investigate their environments for evidence of exploitation. Potential indicators include suspicious activity involving the PaperCut Application Server process, particularly `pc-app.exe`. Security teams should also investigate: * Missing or unexpectedly truncated PaperCut `server.log` files * Deleted PaperCut logs * Unexpected changes to PaperCut configuration * Suspicious Java processes originating from the PaperCut application * Unexpected command-shell activity * Unusual system-discovery commands * Suspicious network connections involving the PaperCut Application Server * Unexpected files created in PaperCut directories Security researchers have also identified suspicious PaperCut log entries that organizations can use during investigations, including errors associated with unusual database driver activity. However, organizations should avoid treating individual indicators as definitive proof of compromise. Incident responders should correlate PaperCut logs with endpoint, identity, firewall, proxy and network telemetry. ## What Should Organizations Do About the PaperCut Vulnerability? Organizations using PaperCut NG or MF should take several immediate steps. ### 1\. Restrict Internet Access The first priority is to determine whether any PaperCut Application Server is accessible from the public internet. If it is, restrict access to trusted IP addresses or internal networks. PaperCut recommends this mitigation even for organizations that have not identified evidence of compromise. ### 2\. Install Emergency Patch Release 2 Organizations should install the latest emergency patch applicable to their PaperCut deployment. Emergency Patch Release 2 contains additional hardening following research into bypasses affecting the initial remediation. Do not assume that installing the first emergency patch resolves the issue. ### 3\. Identify All PaperCut Servers Security teams should conduct an asset inventory to identify every PaperCut NG and PaperCut MF Application Server. This includes servers that may have been deployed by individual departments or business units outside the organization's central IT team. External attack-surface management can also help identify PaperCut installations that may have been unintentionally exposed to the internet. ### 4\. Investigate for Prior Exploitation Patching a vulnerable server does not establish whether it was previously compromised. Organizations with internet-facing PaperCut servers should review historical logs and security telemetry for suspicious activity dating back to at least the period when exploitation was first observed. This should include PaperCut logs, endpoint detection data, network traffic, firewall logs and reverse-proxy records. ### 5\. Isolate Compromised Systems If evidence of compromise is identified, organizations should activate their incident-response procedures. Depending on the circumstances, this may include isolating the PaperCut server, preserving forensic evidence, reviewing credentials and investigating potential lateral movement. Security teams should avoid simply rebuilding or deleting a compromised server before relevant evidence has been preserved. ### 6\. Continue Monitoring Vendor Guidance The PaperCut investigation remains ongoing. The company has said it will provide additional verified indicators and guidance as its investigation progresses. Organizations should continue monitoring PaperCut's security advisory and relevant government and security research sources for [additional remediation information](https://www.packetlabs.net/posts/remediating-test-findings/). ## Why the 2026 PaperCut Vulnerability Is Significant The PaperCut vulnerabilities highlight several broader cybersecurity challenges. ### Vulnerabilities Can Become More Dangerous When Chained A high-severity authentication bypass and a critical code-execution vulnerability are serious independently. When attackers can combine them into an unauthenticated RCE chain, however, the overall risk becomes substantially greater. Security teams therefore need to evaluate **attack paths**, rather than considering individual CVEs in isolation. ### Emergency Patches Can Require Follow-Up The PaperCut incident also demonstrates why organizations need a process for validating emergency patches. An emergency update may close an immediately identified attack path without addressing every possible way the underlying functionality can be abused. The discovery of bypasses led PaperCut to release a second emergency patch with additional hardening. Organizations should therefore monitor vendor advisories after deploying an emergency fix rather than immediately considering the incident closed. ### Patching and Incident Response Are Different Activities One of the most important lessons is that vulnerability remediation does not replace incident response. If an attacker exploited a vulnerable PaperCut server before it was patched, installing the patch does not necessarily remove persistence or determine whether the attacker accessed other systems. Organizations need to ask two separate questions: * _Is the vulnerability fixed?_ * and _Was the system compromised before it was fixed?_ Both questions need to be answered. ## PaperCut Vulnerability Adds to a History of Targeting Print Management Software The PaperCut incident is also notable because the company experienced a major wave of cyberattacks in 2023. That campaign targeted vulnerabilities in PaperCut NG and MF and included attacks against organizations in the education sector. The recurrence of PaperCut as an attractive target demonstrates why print-management infrastructure should be incorporated into enterprise vulnerability-management programs. Organizations should not assume that print servers are low-value assets simply because they are not directly associated with sensitive databases or customer-facing applications. Attackers often target systems that provide a useful combination of network access, trusted software and insufficient security monitoring. ## How Security Teams Can Reduce PaperCut Risk Beyond addressing the current CVEs, organizations can take several steps to reduce their longer-term exposure. These include: * Maintain an accurate inventory of PaperCut installations. * Keep PaperCut NG and MF updated. * Remove unnecessary internet exposure. * Place administrative interfaces behind appropriate network controls. * Monitor application servers with endpoint detection and response tools. * Centralize and retain application logs. * Monitor unusual child processes and command execution. * Apply network segmentation to print infrastructure. * Use least-privilege access controls. * Establish emergency patching procedures for actively exploited vulnerabilities. * Integrate CISA KEV vulnerabilities into vulnerability-prioritization workflows. Organizations should also regularly test whether supposedly internal management interfaces are actually accessible from external networks. ## What the PaperCut Attack Teaches Organizations The PaperCut vulnerability incident is a reminder that cybersecurity teams cannot rely exclusively on traditional patch cycles. When a vendor confirms active exploitation, the appropriate response changes. Organizations need to rapidly determine: * Do we use the affected product? * Is our installation vulnerable? * Is it exposed to the internet? * Has the latest patch been installed? * Could the system have already been compromised? Those questions should drive the response. The PaperCut incident also demonstrates the importance of threat intelligence. Researchers identified exploitation, developed working exploit chains and discovered weaknesses in the initial remediation while PaperCut continued its investigation. That information allowed defenders to understand the threat more quickly and adjust their response. ## Conclusion The PaperCut vulnerability affecting NG and MF represents a serious and actively exploited cybersecurity threat. CVE-2026-81578 and CVE-2026-82078 can be chained to enable unauthenticated remote code execution, potentially allowing attackers to take control of vulnerable PaperCut Application Servers. PaperCut has released Emergency Patch Release 2 after researchers identified bypasses affecting the initial remediation. Organizations should therefore ensure they have installed the latest available emergency patch rather than relying on the first update. The Canadian Centre for Cyber Security reports that both vulnerabilities are being exploited in the wild and that CISA added the CVEs to its Known Exploited Vulnerabilities catalog on August 31. Organizations using PaperCut NG or MF should immediately restrict public access to Application Servers, deploy Emergency Patch Release 2 and investigate potentially exposed systems for signs of compromise. Most importantly, organizations should remember that [patching is only one part of the response](https://www.packetlabs.net/posts/patch-management-best-practices/). If a vulnerable PaperCut server was exposed during active exploitation, security teams should determine whether attackers gained access before remediation. ## Frequently Asked Questions About the PaperCut Vulnerability ## What is the PaperCut vulnerability? The current PaperCut security issue involves two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, affecting PaperCut NG and PaperCut MF. The flaws can be chained to potentially achieve unauthenticated remote code execution. ## What is CVE-2026-81578? CVE-2026-81578 is an improper access-control vulnerability in the PaperCut NG and MF web management interface. It has a CVSS 4.0 score of 8.8 and can allow unauthenticated attackers to modify certain system configurations. ## What is CVE-2026-82078? CVE-2026-82078 is an unsafe dynamic class-loading vulnerability in PaperCut's database connection utilities. It has a CVSS 4.0 score of 9.4 and can potentially enable arbitrary Java code execution when an attacker can manipulate relevant configuration parameters. ## Are the PaperCut vulnerabilities actively exploited? Yes. PaperCut has confirmed customer incidents involving active exploitation. The Canadian Centre for Cyber Security has also reported exploitation in the wild and says CISA added both CVEs to its KEV catalog on August 31, 2026. ## Does the PaperCut vulnerability allow remote code execution? Yes. Researchers have demonstrated that the two vulnerabilities can be chained to create a pre-authentication remote code execution attack against vulnerable PaperCut installations. ## Which PaperCut products are affected? The vulnerabilities affect **PaperCut NG and PaperCut MF**. The Canadian Cyber Centre identifies versions prior to Emergency Patch Release 2 for major versions 24, 25 and 26 as affected. ## Is the first PaperCut emergency patch enough? No. PaperCut subsequently released **Emergency Patch Release 2** after researchers identified bypasses and additional security issues. Organizations should verify that they have deployed the latest emergency remediation. ## Should PaperCut servers be exposed to the internet? Organizations should avoid exposing PaperCut Application Servers directly to the public internet. PaperCut recommends restricting access to trusted IP addresses or internal networks. ## How can organizations detect PaperCut exploitation? Security teams should review PaperCut server logs, endpoint telemetry, network traffic, firewall and proxy logs and configuration changes. Suspicious activity involving `pc-app.exe`, missing or truncated logs, unexpected Java processes and unusual command execution should be investigated. ## Does patching the PaperCut vulnerability remove an attacker? Not necessarily. Patching prevents exploitation of the vulnerability going forward, but it does not determine whether an attacker already compromised the system. Organizations should investigate potentially exposed servers for evidence of prior exploitation. ## Why are the PaperCut CVEs considered serious? The vulnerabilities are particularly dangerous because they can be chained to provide unauthenticated remote code execution. The risk is further increased when vulnerable PaperCut Application Servers are exposed to the public internet. ## What should organizations do first? The immediate priorities are to restrict public access to PaperCut Application Servers, install Emergency Patch Release 2 and investigate potentially exposed systems for signs of compromise.