What Happened?
- On August 27, 2026, PaperCut warned customers that attackers were actively exploiting a vulnerability affecting PaperCut NG/MF and urged organizations to restrict Internet access to exposed PaperCut Application Servers.
- On August 28, PaperCut released Emergency Patch Release 2 after researchers identified multiple ways to bypass the original emergency fixes.
- The initial remediation itself was found to have bypasses while exploitation was already occurring.
The Timeline
- August 27, 2026: PaperCut disclosed active exploitation and released an emergency patch.
- August 28, 2026: PaperCut disclosed CVE-2026-81578 (CVSS 8.8 โ High) and CVE-2026-82078 (CVSS 9.4 โ Critical).
The Attack Chain
- 1 โ Reach the PaperCut web interface: The attacker needs network access to the vulnerable Application Server; Internet exposure is a critical factor.
- 2 โ Bypass authorization: CVE-2026-81578 can allow certain unauthenticated remote requests to trigger backend administrative actions before authorization checks are properly completed.
- 3 โ Manipulate trusted configuration: The source post's Huntress analysis describes using the authentication bypass to manipulate server configuration.
- 4 โ Abuse dynamic class loading: CVE-2026-82078 affects database connection utilities that dynamically load database driver classes without adequately restricting driver names to an approved allowlist.
- 5 โ Remote Code Execution: The two vulnerabilities can be chained from unauthenticated access โ configuration manipulation โ arbitrary Java code execution.
Technical Breakdown
- CVE-2026-81578 โ Improper Access Control: CVSS 8.8; potential authentication bypass, unauthorized administrative actions, configuration manipulation and chaining.
- CVE-2026-82078 โ Unsafe Dynamic Class Loading: CVSS 9.4; attacker-controlled configuration can lead through dynamic class loading to Java bytecode execution and RCE.
Why the Second Patch Is Important
- Researchers from watchTowr and Huntress found multiple ways to bypass the original remediation.
- Huntress reported reproducing the full pre-authentication RCE chain in customer environments and observing exploitation in two customer environments.
- PaperCut released Emergency Patch Release 2 with additional hardening.
- If you already installed the first emergency patch: UPDATE AGAIN.
What Huntress Found
- Huntress observed system-reconnaissance commands including
whoami & ver. - Researchers observed Java .class files being used as an RCE bridge between PaperCut and the underlying operating system.
- The source post reports activity involving
Udydn.outunder/data/content/, followed by deletion of that file,server.logand/data/internal/derby.log.
Indicators of Compromise / Hunting Clues
- Process:
pc-app.exe. - Logs: missing, truncated or deleted
server.log, unexpected modifications and suspicious errors. - Investigation clues:
ERROR No suitable driver found for jdbc:no:xandERROR DatabaseUtils - Database error looking up cardID: VALUES CAST. - Additional indicators:
Udydn.outand suspicious Java .class files or command execution associated with the PaperCut Application Server. - These are hunting indicators, not proof of compromise; their absence does not prove a server was not compromised.
Who Is Affected?
- Emergency Patch Release 2 applies to PaperCut NG and MF versions 24, 25 and 26, according to the source post.
- Customers running version 23 or earlier should upgrade to a supported/latest version.
What Organisations Should Do Now
- PATCH โ AGAIN: Install Emergency Patch Release 2.
- REMOVE INTERNET EXPOSURE: Restrict the Application Server web interface to trusted IPs using firewall rules, NAC, VPN, segmentation or ACLs.
- INVESTIGATE BEFORE YOU PATCH: Patch โ Incident Response.
- REVIEW ENDPOINT TELEMETRY: Search EDR/XDR/SIEM for
pc-app.exe, unusual child processes, command shells, Java, PowerShell, network connections and file activity. - CHECK LOG INTEGRITY: Investigate
server.logfor truncation, deletion, timestamp gaps and suspicious errors. - REVIEW NETWORK ACTIVITY: Look for unexpected external IPs, unusual DNS and unknown outbound connections.
- INVESTIGATE LATERAL MOVEMENT: Assess access to Active Directory, file servers, print infrastructure, databases, administrative systems, service accounts and network shares.
Why PaperCut Is an Attractive Target
- PaperCut can interact with printers, user accounts, enterprise networks, files, authentication infrastructure and internal systems.
- A vulnerable Internet-exposed Application Server can therefore be valuable to attackers.
- The source post also notes the 2023 exploitation of CVE-2023-27350.
The Big Lesson
- The first patch may not be the final answer.
- When a vulnerability is actively exploited, Internet reachable, pre-authentication and capable of RCE, the response needs to be aggressive.
- When researchers discover patch bypasses, the vulnerability-management cycle starts again.
CyberRakshakLabs Threat Assessment
- Attack Complexity: High Risk
- Authentication Required: Potentially None
- User Interaction: None
- Exploitation: Confirmed in the wild
- Impact: Remote Code Execution
- Primary Risk: Compromise of PaperCut Application Servers
- Secondary Risk: Potential lateral movement into internal networks
- Priority: CRITICAL โ PATCH + HUNT + RESTRICT
Security Team Checklist
- โ Identify all PaperCut NG/MF servers
- โ Determine version
- โ Install Emergency Patch Release 2
- โ Upgrade unsupported versions
- โ Remove unnecessary Internet exposure
- โ Restrict management interface to trusted IPs
- โ Review server.log
- โ Search for suspicious pc-app.exe activity
- โ Search for Udydn.out
- โ Search for suspicious Java .class files
- โ Review EDR/XDR alerts
- โ Review outbound network traffic
- โ Investigate authentication events
- โ Check for lateral movement
- โ Preserve forensic evidence if compromise is suspected
The Most Important Question
- Don't ask only: โDid we install the patch?โ
- Also ask: โWas our PaperCut server exposed while the vulnerability was being actively exploited?โ
- And: โDo we have evidence that someone actually accessed it?โ
- That's the difference between Vulnerability Management and Incident Response.
Final CyberRakshakLabs Message
- 1. PREVENT โ Patch and restrict exposure.
- 2. DETECT โ Hunt for exploitation and post-exploitation activity.
- 3. RESPOND โ Investigate compromised systems and potential lateral movement.
- A patched server can still be a compromised server.
- If the attacker was already inside before the patch, the patch may close the door โ but it does not tell you whether someone already walked through it.
- PATCH. HUNT. VERIFY.
๐ก๏ธ CyberRakshakLabs Threat Assessment
CRITICAL โ PATCH + HUNT + RESTRICT
PATCH. HUNT. VERIFY.