www.it-connect.fr
PaperCut NG/MF: Two Exploited Flaws and a Bypassed Fix
Are you using PaperCut NG and PaperCut MF? You need to patch your server immediately. And if you did so recently, it is very likely you will need to do it again. Here’s why, and how to protect yourself against the two exploited security flaws: CVE-2026-81578 and CVE-2026-82078.
In schools, local government offices, and businesses, PaperCut tools are widely used. They are used to track, bill, and secure printing: PaperCut NG manages print queues on the server side, while PaperCut MF adds direct integration with multifunction copiers. In this security alert, the affected component is the Application Server, and it is often exposed to the Internet to meet the needs of remote users.
Two flaws chained together to achieve RCE
On August 28, 2026, PaperCut published a new security bulletin describing two new vulnerabilities, as follows:
- CVE-2026-81578 (CVSS 8.8, high): an authentication bypass in the web administration interface of PaperCut NG and MF. It allows an unauthenticated attacker to change the server configuration.
- CVE-2026-82078 (CVSS 9.4, critical) : unsafe dynamic class loading in the database connection utilities (a driver name validation issue). It allows an attacker to execute arbitrary Java code.
Following this disclosure, Rapid7 published a more detailed analysis of these vulnerabilities. It provides more insight into how these flaws work, including the one that enables the authentication bypass.
"PaperCut uses the Apache Tapestry framework, whose ‘direct complex’ request format makes it possible to identify one page to display and another page containing the component to execute. PaperCut only validates access to the displayed page. By choosing either the public error page or the exception page, an attacker can bypass authentication while invoking administrative components belonging to ConfigEditor or UserList.", it says.
From there, the attacker can chain the second security flaw. The forged requests modify external user search settings to point to a malicious JDBC connection. The embedded Apache Derby driver then opens an attacker-controlled URL designed to trigger a JavaScript payload. The final step in the chain comes from the Nashorn engine present in PaperCut: it is what launches a system process.
The first fix was bypassed, here is a second one
The first security patch for these vulnerabilities was released as an emergency update on August 28, 2026, for the 25 and 26 branches, and later for branch 24. But later that same evening, PaperCut published a new security patch, again as an emergency release.
This "Emergency Patch Release 2" is intended to fully patch the security flaws. In reality, the first fix could be bypassed. According to Rapid7, it was enough to use the home page as the display page to reproduce the authentication bypass. As a result, any organization that applied the first version of the patch is not protected. You must start over and install patch security v2.
This v2 security update applies to PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS. By contrast, branch 23 will not receive a security update: the vendor advises you to upgrade. The problem is that Huntress says 47% of the roughly 2,500 PaperCut installations it monitors are still running version 23 or earlier, meaning no patch is available....
That is a problem, especially since these vulnerabilities are already being exploited: Huntress observed exploitation of these flaws in two customer environments on August 26 and 27. It appears to be reconnaissance activity for now, but cybercriminals are onto it...
This scenario is reminiscent of a painful precedent. In April 2023, PaperCut servers were already targeted through the critical CVE-2023-27350 flaw, before multiple groups, including Clop operators, LockBit, and Iranian state-backed actors, joined the exploitation wave.
