PaperCut — Active Zero-Day Exploitation in Print Management Servers Targeting Data Theft (CVE-2026-81578 & CVE-2026-82078)

Publication date: September 1, 2026
Category: Zero Days / Threat Intelligence

Introduction

During the final week of August 2026, the global enterprise printing ecosystem faced active exploitation campaigns targeting zero-day vulnerabilities in PaperCut NG and PaperCut MF software. Serving over 70,000 organizations and 100 million users worldwide — including large enterprises, educational institutions, and government agencies — the flaws tracked as CVE-2026-81578 and CVE-2026-82078 enable remote threat actors to bypass authentication mechanisms and execute arbitrary code on internet-exposed servers. Threat intelligence provider Defused confirmed that attackers are abusing these flaws in the wild specifically for data theft operations, dumping sensitive database contents rather than deploying traditional ransomware payloads.

What is PaperCut NG/MF and the Vulnerabilities? (General Analysis)

PaperCut NG and PaperCut MF are widely deployed print management solutions designed to track, control, and secure printing services across complex enterprise networks. To facilitate remote management and multi-function device integration, application servers are frequently exposed to internal networks and, in many cases, directly to the public internet.

The newly disclosed flaws exploit logical weaknesses in web management interfaces and database handling utilities:

• CVE-2026-81578: An improper access control vulnerability in the web management interface. It permits unauthenticated remote requests targeting administrative functions to trigger backend actions prior to the completion of access validation checks.
• CVE-2026-82078: An unsafe dynamic class loading vulnerability within database connection utilities, allowing attackers who manipulate configuration parameters to execute arbitrary Java bytecode.
• CVE-2023-2533: A historical cross-site request forgery and remote execution flaw previously tracked in CISA’s KEV catalog.

How Does It Work? (Technical Analysis)

The exploitation chain identified by security analysts demonstrates a methodical approach to bypassing security controls and extracting internal data:

• Initial Access and Authentication Bypass:
  Threat actors transmit crafted HTTP(S) requests to the web management interface of vulnerable PaperCut servers. By leveraging CVE-2026-81578, the backend processes administrative requests aimed at external user-lookup features before validating whether the incoming request originates from an authenticated administrator session, successfully bypassing authentication checks.
• Code Execution via Database Utilities:
  Once configuration parameters can be modified via the hijacked administrative interface, attackers exploit CVE-2026-82078. This flaw misuses database driver instantiation routines within the Apache Derby database connection utilities, allowing dynamic loading and execution of arbitrary Java bytecode under the security context of the PaperCut server process.
• Data Exfiltration Mechanics:
  Unlike previous ransomware campaigns from 2023 (associated with LockBit, Clop, and Bl00dy gangs targeting print archiving features), telemetry from honeypots since late August 2026 indicates that threat actors are actively dumping database tables to exfiltrate sensitive enterprise data directly.

Affected Systems / Environments

• Affected Software: PaperCut NG and PaperCut MF versions preceding the emergency patches released in late August 2026.
• Target Platforms: Application servers running on Windows, Linux, and macOS environments hosting print management services.
• Risk Profile: Organizations maintaining internet-facing PaperCut application servers without strict network perimeter controls, IP whitelisting, or VPN encapsulation.

Mitigation and Detection

Remediation

• Immediate Patching: PaperCut Software has issued successive emergency patches, culminating in Emergency Patch Release 3. All administrators are strongly advised to apply this release immediately, regardless of whether earlier emergency mitigations were already deployed.
• Perimeter Isolation: If patching cannot be performed immediately, administrators must restrict direct internet exposure of the PaperCut web management interface, limiting access exclusively to internal networks or protected VPN tunnels.

Detection

• Monitor application and access logs for anomalous HTTP requests targeting user-lookup functionality or unauthorized modifications to database connection settings.
• Inspect server processes for unexpected child processes spawned by the core Java service of PaperCut.

Threat Intelligence Note: The active abuse of logical flaws in enterprise management software highlights that perimeter infrastructure components serve as critical vectors requiring strict network segmentation and rapid zero-day patch management.

Wrapping Up

The active exploitation of zero-day vulnerabilities CVE-2026-81578 and CVE-2026-82078 in PaperCut NG and MF underscores the ongoing threat to corporate perimeter infrastructure. Threat actors have shifted tactics from ransomware deployment toward targeted data theft by dumping internal databases. The vendor’s release of successive emergency patches emphasizes the critical importance of swift vulnerability management and eliminating unnecessary internet exposure for administrative interfaces.

References

• PaperCut Software. (2026, August 27). Urgent Security Advisory - PaperCut NG/MF Vulnerabilities. [Patch, Vendor Advisory]. https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
• Rapid7. (2026). Metasploit Framework Pull Request #21842. [Issue Tracking, Patch]. https://github.com/rapid7/metasploit-framework/pull/21842
• Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-81578, CVE-2026-82078, CVE-2023-2533). [Patch, Third Party Advisory, US Government Resource]. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Fluid Attacks. (2023). Advisory: PaperCut NG/MF CSRF and RCE (CVE-2023-2533). [Exploit, Third Party Advisory]. https://fluidattacks.com/advisories/arcangel/
• PaperCut Software. (2023, June). Security Bulletin June 2023 (CVE-2023-2533). [Vendor Advisory]. https://www.papercut.com/kb/Main/SecurityBulletinJune2023