Security researchers have reported active exploitation of newly disclosed vulnerabilities affecting PaperCut NG and PaperCut MF, allowing attackers to bypass authentication and execute arbitrary code on vulnerable systems. The activity follows the release of an emergency security update from PaperCut that includes additional hardening measures beyond its original patch. According to Huntress researchers John Hammond and Andrew Brandt, the vulnerabilities enable an unauthenticated attacker to gain control over trusted PaperCut configuration settings, creating a pathway to execute arbitrary Java code within the application’s process. Researchers explained that the attack takes advantage of how certain requests are handled by the web management interface. A specially crafted request can reference one page for rendering while executing components associated with another page. As a result, the authorization process may trust the rendered page while failing to verify the permissions required for the executed component, allowing unauthorized changes to server configuration and access to sensitive administrative functions that ultimately enable remote code execution.
PaperCut has publicly disclosed two vulnerabilities associated with the attacks. The first, tracked as CVE 2026 82078 with a CVSS score of 9.4, is an unsafe dynamic class loading vulnerability affecting the database connection utilities in PaperCut NG and PaperCut MF. According to the advisory, the application loads database driver classes based on configurable driver names without validating them against an approved allow list, creating an opportunity for arbitrary code execution. The second issue, CVE 2026 81578 with a CVSS score of 8.8, is an improper access control vulnerability in the web management interface that allows specially crafted unauthenticated requests to trigger backend administrative actions before access validation is completed. Huntress researchers stated that the observed attack chain combines these two vulnerabilities, enabling attackers to first bypass authentication and then exploit the configuration mechanism to achieve remote code execution. WatchTowr also confirmed that threat actors are chaining both vulnerabilities together, explaining that the authentication bypass provides access to modify configuration files, which are then used to trigger the unsafe class loading vulnerability. The company further reported discovering multiple methods capable of bypassing the initial security patches, including an additional authentication bypass vulnerability. While PaperCut addressed one of the identified bypass techniques in its second emergency update, researchers indicated that further patch bypass methods affecting the latest fully patched version have also been identified.
Researchers from Huntress observed limited exploitation in two customer environments where attackers executed Base64 encoded commands following successful compromise. The commands were primarily used to identify the operating system and active user account by running the chained command “whoami & ver.” During the attacks, a Java class file capable of operating on both Windows and Linux systems was deployed to collect information about the targeted environment. According to the researchers, the file gathered system details, generated directory listings, and stored the collected information in a file named “Udydn.out” located within the application’s data content directory. After completing the information gathering process, the malware removed the output file along with PaperCut server log files and Derby database log files in an apparent effort to reduce forensic evidence. Huntress also documented another incident on August 27, 2026, where attackers used an updated version of the same Java class file to execute an expanded command that also collected a list of running processes using “whoami & ver & tasklist.” Researchers said the observed activity currently appears to focus on reconnaissance and system validation rather than immediate deployment of additional malicious payloads, although the ultimate objective of the attackers remains unclear.
Security researchers have advised organizations using PaperCut NG or PaperCut MF to immediately remove public internet exposure wherever possible and deploy the latest security updates without delay. Additional recommendations include restricting access to the PaperCut Application Server to trusted IP addresses or placing the management interface behind a virtual private network or another controlled administrative access method. Researchers also encouraged organizations to review systems for indicators of compromise, including unusual database related errors such as “Database error looking up cardID: VALUES CAST” within application log files. According to watchTowr, PaperCut represents an attractive target because it often serves as an internet accessible entry point into enterprise environments while also storing sensitive printed documents that could be accessed or extracted if compromised. The latest findings highlight the importance of applying vendor updates promptly, limiting external access to administrative interfaces, and monitoring enterprise applications for unusual activity following the disclosure of critical vulnerabilities.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
