PaperCut — Zero-Day Exploitation in Print Management Servers Affects All NG and MF Versions (CVE-2026-81578 / CVE-2026-82078)

Publication date: August 28, 2026
Category: Vulnerability / Enterprise Security

Introduction

PaperCut has issued an urgent security advisory warning customers that malicious actors are actively exploiting zero-day vulnerabilities affecting all versions of its PaperCut NG and PaperCut MF print management software. The active exploitation campaign leverages an attack chain combining access control flaws and unsafe dynamic class loading to achieve unauthenticated remote code execution on targeted servers. The company has rolled out emergency patches for v25 and v26 branches, while cybersecurity authorities actively track compromised enterprise infrastructure.

What is PaperCut NG and MF? (General Analysis)

PaperCut NG and PaperCut MF are widely deployed enterprise software solutions designed for print management, cost control, and auditing across organizations of all sizes. Due to their centralized architecture, these application servers are frequently deployed internally and, in many cases, exposed to the perimeter or the public internet to facilitate mobile printing and remote administration.

The compromise of a PaperCut server serves as a critical entry vector for advanced threat actors, as the service typically operates with elevated privileges (SYSTEM or root) on the underlying operating system. Historically, these platforms have been targeted by financially motivated groups and ransomware operators, as demonstrated in 2023 by the exploitation of CVE-2023-27350.

Official metrics for the vulnerabilities involved in the PaperCut ecosystem include:

  • CVE-2023-27350 (Historical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL). CWE-284 (Improper Access Control). Listed in the CISA KEV catalog.
  • CVE-2026-81578 (Current): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X — 8.8 (HIGH). CWE-305 (Authentication Bypass by Primary Irregularity / Improper Access Control). Listed in the CISA KEV catalog.
  • CVE-2026-82078 (Current): CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X — 9.4 (CRITICAL). CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Dynamic Class Loading). Listed in the CISA KEV catalog.

How Does It Work? (Technical Analysis)

The ongoing campaign relies on a coordinated exploitation chain that bypasses validation and control mechanisms within the PaperCut web management interface:

  • Initial Entry and Validation Bypass (CVE-2026-81578): An unauthenticated remote attacker sends crafted HTTP requests targeting administrative functions on the web server. Under specific conditions, the backend triggers actions prior to the completion of access validation checks, allowing unauthorized modification of critical system configuration parameters.
  • Code Execution via Unsafe Dynamic Class Loading (CVE-2026-82078): Capitalizing on the ability to manipulate system configuration parameters from the previous step, the attacker exploits PaperCut’s database connection utilities. The application instantiates database driver classes based on configurable names without validating against an approved allowlist, leading to the execution of arbitrary Java bytecode under the security context of the PaperCut server process.
  • Post-Exploitation and Artifacts: Once access is secured, threat actors execute secondary tools and utilities through the application server binary, leaving traces on the operating system and tampering with or deleting local audit logs to hinder forensic analysis.

Affected Systems / Environments

All versions of PaperCut NG and PaperCut MF are considered exposed to the underlying vulnerabilities, requiring prioritized patching across active support branches.

CVECategory (CWE)ImpactCVSSVector (summarized)
CVE-2023-27350CWE-284Remote Code Execution / Bypass9.8 (Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-81578CWE-305Configuration Modification / Bypass8.8 (High)AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L
CVE-2026-82078CWE-470Remote Code Execution (Java Bytecode)9.4 (Critical)AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H

Mitigation and Detection

Remediation

  1. Patch Deployment: Immediately upgrade PaperCut NG and MF servers to the vendor-patched versions (initially released for v25 and v26 branches).
  2. Strict Perimeter Restriction: If application servers are directly exposed to the internet, immediately restrict access to web interfaces using firewall rules or network access controls, permitting connections solely from trusted corporate IP addresses.

Detection

Blue Team defenders should actively monitor environments for the following Indicators of Compromise (IoCs):

  • EDR or network-monitoring alerts involving the PaperCut Application Server, particularly suspicious post-exploitation activity originating from the pc-app.exe process.
  • Missing, unexpectedly truncated, or deleted server.log files.
  • The presence of the following anomalous entries in server logs:
    text 
    ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

“Take immediate action to restrict PaperCut web interfaces from untrusted internet addresses, even if you have not observed suspicious activity in your environment.”

Wrapping Up

The active exploitation of this zero-day chain in PaperCut NG and MF highlights the persistence with which threat actors target exposed enterprise management software. The combination of improper access control and unsafe dynamic class loading exposes core servers to critical code execution risks. Immediate patch deployment and strict perimeter isolation remain indispensable measures to mitigate operational impact across corporate infrastructure.

References