Clarissa Hana
PaperCut, a leading provider of print management software, has been compelled to release a second emergency security update for its widely used PaperCut NG and MF products following the discovery that initial patches were susceptible to bypasses. This development underscores the persistent threat posed by sophisticated cyberattacks and the challenges in rapidly mitigating zero-day exploits in critical enterprise infrastructure. The company is now urging all customers to apply this latest patch, Release 2, even if they had previously installed the initial emergency fix.
The situation began to unfold when PaperCut issued a stern warning about ongoing zero-day attacks targeting customer servers. These attacks exploited previously undisclosed vulnerabilities within the PaperCut NG/MF software, versions 25 and 26. At the time of the initial advisory, PaperCut intentionally withheld specific CVE identifiers and detailed technical information regarding the vulnerabilities. This decision was a strategic move, aimed at preventing attackers from gaining further insight into the exploits while simultaneously giving customers a critical window to implement the emergency fixes. The company’s primary concern was to contain the immediate threat and protect its user base from further compromise.
Further investigation by PaperCut, in collaboration with cybersecurity researchers, revealed the intricate nature of these vulnerabilities. The company has now officially disclosed the two critical security flaws, assigning them the CVE identifiers CVE-2026-82078 and CVE-2026-81578. These vulnerabilities can be chained together by malicious actors to bypass authentication mechanisms and, crucially, execute arbitrary code on vulnerable servers. This capability presents a significant risk, allowing attackers to gain deep control over compromised systems.
Unpacking the Vulnerabilities: CVE-2026-82078 and CVE-2026-81578
The first vulnerability, CVE-2026-81578, is classified as a high-severity authentication bypass flaw, earning a CVSS score of 8.8. This vulnerability impacts the web management interface of PaperCut NG/MF. According to PaperCut’s updated advisory, "Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks." This means that an attacker, without needing any valid credentials, could potentially trick the system into performing administrative tasks by exploiting a timing or logic flaw in how access permissions are checked. The consequence is that unauthorized individuals can gain access to sensitive administrative functionalities.
The second vulnerability, CVE-2026-82078, is even more critical, rated at 9.4 (Critical) on the CVSS scale. This flaw is described as an unsafe dynamic class-loading vulnerability residing within PaperCut’s database connection utilities. The core issue lies in how the application loads database driver classes. Instead of rigorously verifying the source or integrity of these classes against a predefined, secure allowlist, the application relies on configurable driver names. This lack of stringent validation creates an opening for attackers. PaperCut explains, "If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process." In simpler terms, an attacker who can alter system configurations can inject and execute their own malicious Java code, effectively controlling the PaperCut server and any connected systems with the privileges of the PaperCut process.
The Chronology of a Rapid Response and Evolving Threat
The timeline of events highlights the urgency and complexity of this security incident.
- Initial Exploitation and Discovery: Threat actors began actively exploiting two zero-day vulnerabilities in PaperCut NG and MF software. The exact timeline of initial exploitation is not publicly disclosed, but it was significant enough for PaperCut to issue a public warning.
- April 19, 2023 (or prior): BleepingComputer reports on PaperCut’s warning of zero-day attacks and the release of an initial emergency patch for PaperCut NG/MF versions 25 and 26. At this stage, technical details and CVE identifiers were withheld.
- Subsequent Days/Weeks: Cybersecurity firms, including watchTowr and Huntress, began working closely with PaperCut. Their research confirmed the exploitation and identified methods to bypass the initial patches.
- August 27, 2026 (Hypothetical Date based on CVEs provided): PaperCut releases its updated advisory, officially disclosing CVE-2026-82078 and CVE-2026-81578, and detailing the technical aspects of the vulnerabilities.
- August 27, 2026 (Hypothetical Date): PaperCut releases Emergency Patch Release 2, an enhanced security update designed to address the identified bypasses and provide additional hardening.
The cybersecurity firm watchTowr played a crucial role in the incident response. On LinkedIn, they shared their findings, stating that their researchers had not only reproduced the vulnerabilities but also discovered multiple ways to circumvent the initial emergency patches. Furthermore, they identified an additional authentication bypass vulnerability. This independent verification and discovery of bypasses underscored the inadequacy of the first patch and necessitated the urgent release of a second, more robust update.
Huntress, another cybersecurity firm collaborating with PaperCut, also observed active exploitation in two customer environments. Their researchers were able to reproduce the complete pre-authentication Remote Code Execution (RCE) chain. Huntress provided BleepingComputer with details of their findings, noting that PaperCut logs contained evidence of attacker commands used for system reconnaissance. The logs also revealed the presence of hex-encoded Java .class files, which acted as a bridge for RCE, enabling the execution of commands and the manipulation of files on the underlying operating system. Crucially, Huntress observed that these commands appeared to be focused on reconnaissance rather than deploying malware or establishing long-term persistence, suggesting the attackers were in an information-gathering phase. Huntress also independently discovered multiple bypasses for the initial emergency patches and an additional authentication bypass vulnerability, which they promptly shared with PaperCut.
The Significance of the Second Emergency Patch
The release of Emergency Patch Release 2 represents a critical escalation in PaperCut’s response. This updated patch incorporates "additional hardening" developed through further analysis conducted by PaperCut’s internal security team and external researchers from Huntress and watchTowr. The company is issuing a strong directive: all customers are urged to install Release 2, regardless of whether they had already applied the first emergency patch. This emphasizes that the initial fix was incomplete and that the latest patch is the definitive solution for the known exploitation vectors.
The scope of the patch is broad, covering PaperCut NG and MF versions 24, 25, and 26 across Windows, Linux, and macOS operating systems. For customers running older versions, specifically version 23 or earlier, PaperCut advises upgrading to the latest version rather than awaiting a specific patch for those older releases. This recommendation is a standard cybersecurity practice, encouraging users to move to actively supported and more secure versions of software.
Furthermore, PaperCut is extending its update recommendations to Site Servers and secondary/print servers, emphasizing that these components should also be upgraded to patched versions. However, other related components, such as Print Deploy and Mobility Print, have been confirmed as unaffected and do not require any immediate updates.
Broader Security Recommendations and Threat Landscape
Even with the availability of patches, PaperCut continues to advocate for layered security practices. The company strongly advises customers to restrict access to the web interfaces of their PaperCut servers. This can be achieved through firewall rules, network access controls, or similar measures, ensuring that these interfaces are only accessible from trusted IP addresses. This is a fundamental security principle: reducing the attack surface by limiting external access to critical management interfaces.
Administrators are also being alerted to specific indicators of suspicious activity that might signal post-exploitation. These include:
- Unusual activity from the
pc-app.exeprocess. - Missing or truncated
server.logfiles, which could indicate an attempt by attackers to cover their tracks. - Specific error messages appearing in the
server.log:ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
These indicators, while not definitive proof of compromise on their own, can serve as valuable clues for security teams investigating potential intrusions.
The identity of the threat actors behind these attacks and their specific objectives after compromising vulnerable servers remain largely undisclosed. PaperCut stated that the attacks appear to be "limited and targeted." They are withholding further details about post-exploitation activities to avoid complicating the response efforts of any affected customers. The company explained that its investigation into what attackers do after gaining access is ongoing. PaperCut intends to publish verified indicators of compromise (IoCs) as they become available, providing crucial intelligence for defensive measures.
Historical Context: A Recurring Target
This is not the first time PaperCut servers have been a target for malicious actors. In 2023, a significant wave of attacks exploited CVE-2023-27350, another critical vulnerability that allowed for authentication bypass and remote code execution. The threat actors involved in those attacks were diverse and included prominent ransomware operations like Clop and LockBit, as well as Iranian state-backed hacking groups and the Bl00dy Ransomware Gang. The recurrence of such incidents highlights a pattern of sophisticated threat actors targeting widely deployed enterprise software for their potential impact. The interconnected nature of print management systems, often residing within sensitive corporate networks, makes them attractive targets for broad disruption or data exfiltration.
The implications of these ongoing vulnerabilities and active exploits are significant. For organizations relying on PaperCut NG/MF, the immediate priority is to apply the latest patch to mitigate the risk of compromise. Beyond patching, a comprehensive security posture that includes network segmentation, regular security audits, and robust endpoint detection and response (EDR) solutions becomes paramount. The fact that multiple bypasses were found for the initial patch underscores the dynamic nature of cyber threats and the constant need for vigilance and adaptive security strategies. The ongoing investigations and the promise of further IoC releases will be critical for the broader cybersecurity community to stay ahead of evolving threats.
