PaperCut Under Attack: Two Flaws Allow Pre-Authentication RCE, Race to Patch

Active Exploitation Confirmed by PaperCut and Huntress

On August 27, 2026, PaperCut confirmed active exploitation of a pre-authentication remote code execution vulnerability in its MF and NG products. The Huntress team, which collaborated with the vendor, documented exploitation in two customer environments and reproduced the full attack chain against a clean installation of PaperCut NG 25.0.11.75758. Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. The observed activity was limited to system reconnaissance: no secondary malware, command-and-control traffic, or persistence emerged from the analyzed payload.

Attack Chain: Unauthorized Access and Java Class Loading

The compromise combines two vulnerabilities. The first, CVE-2026-81578, is an access control error in the PaperCut MF and NG web management interface. The NVD description explains that, under specific conditions, unauthenticated remote requests can trigger administrative actions before validation checks are completed. An attacker can therefore modify certain system configurations without credentials. The NVD entry does not include a CVSS score, vector, CWE class, or inclusion in CISA's KEV catalog.

The second flaw, CVE-2026-82078, affects PaperCut database utilities and allows loading unsafe Java classes. This enables execution of arbitrary Java code on the server.

Huntress describes the mechanism as a crafted request: the server displays one page but executes an action originating from another page. PaperCut checks permissions for the displayed page, not the action actually performed. The attacker thus modifies configuration without login and, combining the two flaws, achieves code execution.

Affected Versions and Patch Status

Huntress estimates that approximately 47% of the 2,500 PaperCut installations it tracks still use version 23 or earlier. For these versions, at the time of the report published on August 30, no patch exists. The second confirmed compromise hit a server running version 24, for which fixes were still in development. PaperCut released first an emergency patch and then a second update less than 24 hours later, following additional testing. Huntress's reproduction occurred on PaperCut NG 25.0.11.75758, an unpatched installation on Windows.

Reconnaissance, Not Yet Destruction: What Was Observed

In the two documented real-world incidents, attackers did not deploy secondary malware or establish persistence. The first lasted less than two minutes and executed the commands whoami and ver. In the second, tasklist was added to list processes. This is typical system discovery activity: the authors are mapping the environment. However, Huntress reproduced unauthenticated remote code execution on Windows: the pc-app.exe process spawned charmap.exe with SYSTEM privileges, the highest available level. An attacker who reaches this level can fully compromise the server. Internet-exposed PaperCut servers, common in schools, hospitals, and offices, are natural targets.

Indicators of Compromise: What to Look for in Logs and Filesystem

During an investigation, Huntress and PaperCut's investigative guide suggest looking for these signals:

• A malicious Java class file dropped directly into the PaperCut installation directory.
• The .class file executes commands, writes output to a temporary file, and deletes both the output and the server.log.
• The .class file deletes its own Udydn.out file and server.log.
• In server.log, the string DB URL: jdbc:derby:memory:pwn appears immediately after a large blob of encoded data.
• In /data/internal/derby.log, the trace memory:...\pwn; remains; the database directory named pwn is considered a high-confidence indicator.
• Commands observed in real attacks: whoami, ver, tasklist.
• Other items to check: pc-app.exe launching a shell or tasklist, unexpected .class files in the lib directory, traces of server.log deletion, the string jdbc:derby:memory:pwn in the Derby log.

How to Defend and What to Do After Patching

For supported versions, the immediate action is to apply the updates released by PaperCut. For those using version 24, fixes were not ready as of August 30: the safest option is to remove the PaperCut Application Server from the public internet and allow access only via VPN or trusted internal network. The same applies to versions 23 and earlier, for which no patch exists.

Installing the patch should not end the response: if the server has been publicly exposed recently, an investigation should be launched. Before restarting the server, save logs and configuration files to preserve evidence. Check whether pc-app.exe has spawned command shells or tasklist, and look for unexpected .class files in the lib directory. Even a two-minute reconnaissance attempt can be an early signal of a more serious attack.