Summary
This Security Bulletin details two chained vulnerabilities, an authentication bypass (CVE-2026-81578, CVSS 8.8 HIGH) and an unsafe dynamic class-loading flaw (CVE-2026-82078, CVSS 9.4 CRITICAL), in PaperCut NG/MF. When chained, they enable pre-authentication remote code execution. The flaws are actively exploited in the wild. PaperCut released Emergency Patch Release 3 on 1 Sept 2026, with fixes in versions 24.1.10, 25.0.13, and 26.0.5. This release incorporates all fixes from Patch Releases 1 and 2.
The authentication bypass grants unauthenticated access to privileged endpoints. The dynamic class-loading flaw can then be used to execute arbitrary code as SYSTEM, enabling attacker reconnaissance and system control. Huntress reported active exploitation in customer environments, including base64-encoded system-discovery commands, dynamic Java .class payload drops such as Udydn.class and Udydn Moo97.class, and SYSTEM-level pc-app.exe activity.
Multiple security firms detected initial exploitation on August 26, 2026, with subsequent incidents confirmed in enterprise and university environments. PaperCut issued emergency advisories and a three-phase emergency patch: Release 1 on August 27, 2026, Release 2 on August 28, 2026, Release 3 on September 1, 2026. As of August 31, both CVEs were added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Organizations running PaperCut on exposed or unpatched systems are at critical risk, with public proof-of-concept exploit code available. Sectors facing elevated threat profiles include organizations in sectors that commonly deploy PaperCut, such as education and healthcare, particularly where print infrastructure is internet-exposed or not regularly updated.
Recommendations
Upgrade to Latest Fixed Version
- Upgrade immediately to Emergency Patch Release 3, released September 1, 2026. It incorporates all fixes from Patch Releases 1 and 2. Organizations that only applied Patch Release 1 or 2 are not fully protected and must apply Patch Release 3.
- PaperCut NG/MF 24.x: 24.1.10
- PaperCut NG/MF 25.x: 25.0.13
- PaperCut NG/MF 26.x: 26.0.5
- PaperCut NG/MF 23.x: Upgrade to a supported branch
Follow your organization’s change-management and testing procedures to minimize operational impact.
Restrict Management Interface Access:
- Remove public/internet exposure of the PaperCut web interface. Restrict access to trusted internal IPs using firewall or network segmentation (close TCP 9191/9192 to external traffic).
Configuration Hardening:
- Where patching is delayed, restrict configuration options (disallow dynamic driver class names, limit SQL templates, enforce allowlists) to mitigate common abuse paths.
Long-Term Remediation:
- Continually verify all PaperCut instances are patched and not exposed to the internet.
- Implement a routine patch management program for third-party services.
- Develop incident response playbooks for future authentication and RCE chain vulnerabilities across similar infrastructure.
Temporary Workarounds
Network Access Controls:
- Strictly limit management interface access (ports 9191/9192) to internal management networks or known administrator subnets using firewall rules or access control lists.
Temporary Configuration Hardening (Limited Efficacy):
- Block or restrict unsafe configuration changes: disallow SQL keywords like CALL, EXEC, or SYSCS_ in external card/ID lookups. Prevent dynamic driver class names in config files.
- Where possible, use only SELECT SQL statement templates and check any unexpected driver configuration.
Limitations: These workarounds cannot fully prevent exploitation and are only effective until patching is complete. Attackers may still find alternate routes if the system is unpatched and exposed. Only vendor-issued security patches fully remediate this threat.
References:
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory
- https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
- https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
