Attackers Exploit Pre-Auth RCE Chain in PaperCut NG and MF
Summary
Huntress reports active exploitation of two PaperCut vulnerabilities chained for pre-authentication RCE, with incidents in two customer environments. PaperCut has issued maintenance releases; organizations should patch and restrict public access.
Key points
- The two flaws, CVE-2026-81578 and CVE-2026-82078, chain to enable unauthenticated remote code execution in the PaperCut Application Server.
- PaperCut NG and MF were affected; Huntress observed exploitation in two customer environments, including versions 25.0.10 and 24.1.5.
- Observed commands identified the account, operating system, and—in one case—running processes; Java class payloads performed system discovery.
- Huntress found log and filesystem clues including unusual Derby database entries, unexpected class files, and missing or truncated server.log files.
- PaperCut issued emergency patches followed by maintenance releases 26.0.5, 25.0.13, and 24.1.10; organizations should install the appropriate supported update.
- Restrict the application server to trusted networks or controlled access, and preserve logs and other evidence before upgrading or restarting.
Article Details
- Vulnerability Types
- Improper access control in the web management interface
- Unsafe dynamic class loading in database connection utilities
- Pre-authentication remote code execution through a chained exploit
- Affected Versions
- PaperCut NG and PaperCut MF: all versions are treated by PaperCut as potentially affected
- PaperCut NG 25.0.11.75758 was successfully exploited in Huntress testing
- PaperCut MF 25.0.10.75465 was observed in an exploited environment
- PaperCut MF 24.1.5.71847 was observed in an exploited environment
- Emergency patches were released for versions 25 and 26; version 24 fixes were initially still in progress
- PaperCut reported maintenance releases 26.0.5, 25.0.13, and 24.1.10 as addressing the issues
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Remove the PaperCut Application Server from public-facing internet connections and restrict access to trusted networks or trusted IP addresses, a VPN, or another controlled administrative path.
- For versions without an available fixed version, treat network isolation as urgent.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | moo97[.]class | Second copy of the malicious Java class payload recovered from an exploited system. |
| HOSTNAME | udydn[.]class | Malicious Java class payload dropped under the PaperCut server installation directory. |
| HOSTNAME | udydn[.]cmd | Command-file artifact identified as an investigation lead associated with the exploitation. |
| HOSTNAME | udydn[.]out | Output artifact created by the malicious Java class during system profiling. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe recovered Java class executed commands on the compromised PaperCut server, including whoami, ver, and tasklist.T1070.004 · File DeletionThe Java class deleted its own output file and the server.log file after executing commands.T1082 · System Information DiscoveryObserved commands whoami and ver were used to identify the account and operating system; tasklist was also used to inspect running processes.T1083 · File and Directory DiscoveryThe recovered Java class obtained a directory listing of files stored on the computer.
CVE
CVE-2026-81578CVE-2026-81578 is an improper access control vulnerability in the web management interface that can allow an unauthenticated attacker to modify system configurations. CVE-2026-82078CVE-2026-82078 is an unsafe dynamic class-loading vulnerability in the database connection utilities that can be used to execute arbitrary Java bytecode.
People
Aaron DealAcknowledged for contributions to the investigation and writeup.Andrew BrandtNamed as an article author.Ben NahorneyAcknowledged for contributions to the investigation and writeup.Craig SweeneyAcknowledged for contributions to the investigation and writeup.Dray AghaAcknowledged for contributions to the investigation and writeup.Jai MintonAcknowledged for contributions to the investigation and writeup.John HammondHuntress article author.Lindon WassAcknowledged for contributions to the investigation and writeup.Lindsey WelchAcknowledged for contributions to the investigation and writeup.Max RogersAcknowledged for contributions to the investigation and writeup.Michael ElfordAcknowledged for contributions to the investigation and writeup.Susannah MattAcknowledged for contributions to the investigation and writeup.Tanner FilipAcknowledged for contributions to the investigation and writeup.
Vendors
Products
PaperCut MFIn an August 27 security advisory, PaperCut said attackers are actively exploiting a pre-authentication remote code execution vulnerability against PaperCut NG and PaperCut MF, with confirmed customer incidents.PaperCut NGIn an August 27 security advisory, PaperCut said attackers are actively exploiting a pre-authentication remote code execution vulnerability against PaperCut NG and PaperCut MF, with confirmed customer incidents.