Attackers Chain Two PaperCut Flaws for Unauthenticated Code Execution
Summary
Huntress and watchTowr report limited exploitation of two PaperCut NG and MF flaws chained for unauthenticated code execution. PaperCut issued a second emergency patch; researchers also identified additional bypasses.
Key points
- CVE-2026-81578 can allow unauthenticated requests to trigger administrative actions before access checks are complete.
- CVE-2026-82078 allows unsafe dynamic loading of database driver classes, which can be abused for code execution.
- watchTowr reports attackers chaining the flaws to bypass authentication and achieve remote code execution.
- Huntress observed limited exploitation in two customer environments, including commands to identify the user account and operating system.
- Attackers also used Java .class files to fingerprint systems and list files; Huntress reported a later variant also collected running processes.
- PaperCut issued a second emergency patch with additional hardening. Researchers reported further bypasses, including bypasses affecting the latest fully patched version.
- Organizations are advised to patch, remove public exposure where possible, restrict administrative access, and hunt for signs of compromise.
Article Details
- Vulnerability Types
- Improper access control allowing unauthenticated requests to trigger administrative actions
- Unsafe dynamic class loading allowing arbitrary code execution
- Severity
- CVSS 9.4 for CVE-2026-82078 and CVSS 8.8 for CVE-2026-81578
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Remove public internet access to PaperCut instances where possible.
- Restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path.
MITRE ATT&CK
T1033 · System Owner/User DiscoveryExecuted commands included whoami to identify the victim server's user account.T1057 · Process DiscoveryA command in one incident included tasklist to enumerate running processes.T1059 · Command and Scripting InterpreterAttackers executed Base64-encoded commands, including commands to identify the user and operating system and, in one incident, list running processes.T1070.004 · File DeletionThe Java class payload deleted its Udydn.out file and the server.log and derby.log files.T1082 · System Information DiscoveryExecuted commands included ver to identify the operating system.T1083 · File and Directory DiscoveryA Java class payload obtained a directory listing of files on the server.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-facing PaperCut NG and MF servers to bypass authentication and achieve remote code execution.
CVE
People
Vendors
Products
PaperCut MFThreat actors are exploiting newly patched flaws in PaperCut NG and PaperCut MF to bypass authentication and execute arbitrary code on vulnerable servers.PaperCut NGThreat actors are exploiting newly patched flaws in PaperCut NG and PaperCut MF to bypass authentication and execute arbitrary code on vulnerable servers.