PaperCut: Two Exploited Zero-Days and a Double Emergency Fix

One advisory and two patches in 48 hours

On August 27, PaperCut Software published a security advisory for two zero-day vulnerabilities in its print management solutions PaperCut NG and PaperCut MF. The following day, August 28, two distinct emergency fixes were released. The first covered versions 25 and 26. The second, published later that same day, added further hardening and was also extended to version 24. PaperCut also made indicators of compromise (IoCs) available.

Initially, attackers were thought to have exploited a single flaw. Analysis by Huntress and WatchTowr later clarified that these are two distinct zero-days, identified as CVE-2026-81578 and CVE-2026-82078.

Two combined flaws: authentication bypass and class loading

CVE-2026-81578 is an improper access control issue, rated high severity. According to the NVD description, in the PaperCut MF and NG web management interface, unauthenticated remote requests to administrative functions can trigger backend actions before access controls are completed. Under certain conditions, an attacker can therefore modify specific system configurations.

CVE-2026-82078 is more severe: critical. It concerns unsafe dynamic class loading in database connection utilities. The application instantiates database driver classes based on configurable names without validating them against an allowlist of approved drivers. If an attacker manages to manipulate configuration parameters—made possible by the authentication bypass—they can achieve arbitrary Java bytecode execution in the context of the PaperCut server process.

The attack chain is clear: first exploit the authentication bypass to alter configuration, then use dynamic loading to execute code on the server.

Observed attacks: system discovery, no secondary payload

Huntress observed attacks against at least two customers. Initial exploitation attempts date back to August 26, the day before the official advisory. Detected activity focused on system discovery. No secondary malware, command-and-control traffic, additional persistence, or post-exploitation activity resulting from the retrieved payload were identified.

WatchTowr reported identifying multiple patch bypasses and an additional authentication bypass flaw: this led to the release of the second emergency patch. Attribution and motives of the attackers remain unknown.

About a thousand internet-exposed instances

According to the Shadowserver Foundation, around 1,000 PaperCut instances are currently reachable from the internet, most in North America and Europe. Although the activity observed so far has been limited to reconnaissance, the combination of the two flaws allows full server compromise, data exfiltration, lateral movement, or ransomware deployment. The campaign could evolve quickly.

What to do: patch, hardening, and indicators

PaperCut recommends urgently applying the emergency fixes. The first covers versions 25 and 26; the second adds hardening and extends to version 24. An official release fixing both CVEs was still in progress at the time of publication. The vendor advisory is being continuously updated.

Organizations should monitor the official advisory, use the IoCs published by PaperCut to detect potential compromise, and limit internet exposure of PaperCut NG/MF instances, especially when they cannot be updated. CISA has not yet added the two new CVEs to the Known Exploited Vulnerabilities (KEV) catalog.

Precedents in KEV: three vulnerabilities, two used in ransomware

The KEV catalog already contains three entries for PaperCut, none of which correspond to the new flaws. Two of the three are known to have been used in ransomware campaigns.

CVE-2023-27350 (CVSS 9.8) was added to KEV on April 21, 2023, with remediation deadline for U.S. federal agencies of May 12, 2023. It enables authentication bypass and code execution in the system context.

CVE-2023-27351 (CVSS 7.5) entered KEV on April 20, 2026, with deadline May 4, 2026. This is also an improper authentication flaw and has been exploited in ransomware campaigns.

CVE-2023-2533 (CVSS 8.4) is a CSRF vulnerability, added to KEV on July 28, 2025 with deadline August 18, 2025. It is not associated with ransomware campaigns.

For all three, CISA recommends applying mitigations according to vendor instructions, following BOD 22-01 guidance for cloud services, or discontinuing the product if mitigations are unavailable. For CVE-2023-27350, the required action is to apply vendor updates.

These precedents show that PaperCut solutions are a recurring target for attackers, including ransomware groups. The new pair of zero-days confirms the risk.