CVE-2026-81578 is a missing-authentication flaw (CWE-306) in the web management interface of PaperCut NG and PaperCut MF, the print-management platform. An unauthenticated remote request reaches an administrative action before the access check completes, so an attacker with no credentials can rewrite server configuration. PaperCut disclosed it in an urgent bulletin dated August 27, 2026, and NVD published the record on August 28. CISA added it to the Known Exploited Vulnerabilities catalog on August 31 with a federal remediation deadline of September 14, alongside its companion CVE-2026-82078.
Scores diverge by source and both are worth carrying. NVD's primary metric is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the vendor, as CNA, scores it CVSS 4.0 8.8. The value on its own does not settle priority here. Two facts do: the vulnerability is being exploited in the wild, confirmed by the vendor, Huntress, and Rapid7, and it chains with CVE-2026-82078 to reach operating-system command execution on the server. On Windows that server process commonly runs as SYSTEM.
The chain is the reason this earns an operational write-up. CVE-2026-81578 supplies the pre-authentication configuration write that CVE-2026-82078 needs. Rapid7 documented the mechanism: the bypass abuses Apache Tapestry's service-URL format, which names one page to render and a different page whose component to execute. PaperCut authorizes only the rendered page, so naming a public page such as Error or Home lets an unauthenticated request drive the configuration editor. The attacker then repoints the external card and ID number lookup at a malicious database driver, and driver initialization runs attacker-supplied logic inside the PaperCut process. PaperCut's first two emergency patches were bypassed within days by researchers at watchTowr, which is why the build number, not the version string, is the only reliable measure of whether a server is protected.
Am I vulnerable?
The vendor states the advisory "applies to all versions of PaperCut NG and PaperCut MF." Any server not running Emergency Patch Release 3 should be treated as exposed, and version 23 and earlier receive no patch at all.
Affected versions
| Product / branch |
Vulnerable until |
Fixed build (Emergency Patch Release 3) |
| PaperCut MF 26.x |
Below 26.0.4 Build 76531 |
26.0.4 Build 76531 |
| PaperCut MF 25.x |
Below 25.0.12 Build 76532 |
25.0.12 Build 76532 |
| PaperCut MF 24.x |
Below 24.1.9 Build 76534 |
24.1.9 Build 76534 |
| PaperCut NG 26.x |
Below 26.0.4 Build 76530 |
26.0.4 Build 76530 |
| PaperCut NG 25.x |
Below 25.0.12 Build 76533 |
25.0.12 Build 76533 |
| PaperCut NG 24.x |
Below 24.1.9 Build 76535 |
24.1.9 Build 76535 |
| PaperCut NG/MF 23.x and earlier |
All versions (no patch) |
Upgrade to a supported major version |
The build number is load-bearing. The version string does not change across the three emergency patches: Release 1 (August 27-28) landed around builds 76496-76497, Release 2 (August 28) around 76507-76508, and only Release 3 (September 1) carries the final builds above. watchTowr bypassed Releases 1 and 2, so a server self-reporting "25.0.12" can still be on the bypassable Release 1. Confirm the build, not just the version.
Site Servers and secondary or print servers run the same component and must be checked and patched too, not only the primary Application Server.
Diagnostic commands
All are read-only.
- Admin UI (authoritative): browse to
http://<server>:9191/admin or https://<server>:9192/admin, open About > Version info, and record both the version and the Build number. For Site Servers, use Sites > Site Server List > [server] > Details. Vulnerable if the build is below the Release 3 build for that branch, or if the major version is 23 or earlier.
- Windows, read the startup log (inferred: the vendor documents the log path but not a ready-made grep):
Select-String -Path 'C:\Program Files\PaperCut MF\server\logs\server.log*' -Pattern 'Build|Version:' | Select-Object -First 5
# NG installs: 'C:\Program Files\PaperCut NG\server\logs\server.log*'
- Linux, read the startup log (inferred, same basis):
sudo grep -m5 -iE 'build|version:' /home/papercut/server/logs/server.log
sudo systemctl status pc-app-server.service # confirms this host is the Application Server
- External exposure probe, run from an untrusted network (identification only, does not reveal the build):
curl -4 -sk -m 10 https://<public-ip>:9192/app | grep -o 'PaperCut'
Any response from outside your network means the interface is internet-reachable and the vendor's first instruction, restricting access to trusted addresses, is not in place.
"Vulnerable" here means any PaperCut Application Server, Site Server, or secondary or print server running below the Release 3 build for its branch, regardless of whether external card lookup was ever configured.
Vulnerability
NVD classifies the root cause as CWE-306, missing authentication for a critical function; the CNA weakness field cites CWE-305, improper restriction of security checks. The practical primitive is the same either way: the management interface performs a privileged action before it finishes deciding whether the caller is allowed to perform it.
Rapid7's analysis identifies the specific mechanism. PaperCut is built on Apache Tapestry, whose "complex direct" service URL format lets a request name one page to render and a separate page whose component method to invoke. PaperCut evaluates authorization against the page it will render, not the component it will execute. By naming a page that is reachable without authentication as the render target, an unauthenticated request drives components belonging to the configuration editor and the user list. The S:U scope in NVD's vector reflects that the impact stays within the application's own authority, but that authority includes rewriting the server's own configuration, which is where the companion bug takes over.
CVE-2026-81578 alone is a configuration-write primitive, and that is already useful to an attacker. Chained with CVE-2026-82078, unsafe reflection in the database-connection utilities (CWE-470), it becomes code execution: the rewritten external-lookup configuration points at a driver the server loads without an allowlist, and connection setup executes attacker logic through the bundled Derby driver and Nashorn engine. Huntress reproduced the full pre-authentication chain against build 25.0.11.75758 and observed exploitation in customer environments beginning August 26, before the vendor's first public report. Public proof-of-concept code is available; a Metasploit module has been proposed upstream.
Threat model
Who would exploit this: The vector favours opportunistic mass-scanning operators. Shadowserver tracked roughly 800 to 1,000 internet-exposed NG/MF servers, mostly in North America and Europe, and exploitation needs no authentication, no user interaction, and low complexity, with public PoCs in circulation. Initial-access brokers form a second tier; watchTowr described the observed second-wave behaviour, including deployed remote-access tooling and access "keyed" to lock out other actors, as consistent with an access broker. State-aligned interest is plausible given this product's history but is not evidenced for this CVE.
What they are after:
- Foothold: pre-authentication code execution on a domain-joined Windows server whose service process runs as SYSTEM. Observed first-day activity was discovery only.
- Persistence and hands-on access: the vendor's indicators include a SimpleHelp remote-access agent installed as an auto-start LocalSystem service, and a follow-on AnyDesk download.
- Lateral movement: watchTowr characterized the deployed tooling as built for external-to-internal pivoting; the print server sits on the internal network with reach to file servers, multifunction devices, and directory services.
- Exfiltration: a separate campaign reported by Defused abuses only the authentication bypass to hijack the external user-lookup and dump database tables directly, without pursuing full code execution.
- Extortion: no ransomware tie is confirmed for this CVE. CISA marks known ransomware use as Unknown for both entries.
Attack chain: An unauthenticated request to the web management interface reaches an administrative action before the access check completes and rewrites the external card and ID lookup configuration. The application then loads a database driver from that attacker-controlled configuration without validating it (CVE-2026-82078), and connection initialization runs attacker code inside the SYSTEM-privileged server process. Observed activity begins with host discovery, then installation of a remote-access agent as a system service and tooling for internal pivoting; a parallel variant skips code execution and pulls database tables through the hijacked lookup.
Blast radius: A compromised server yields SYSTEM on a domain-joined host and the credentials it stores: LDAP and Active Directory bind accounts for directory sync, SMTP settings, and external database connection strings. The user database exposes the directory, card and account numbers, cost-centre structure, and print-job metadata, and document content where job archiving is enabled. The larger consequence is position: print servers are routinely permitted to reach file servers, device subnets, and workstations, which makes the host a ready pivot point. Site Servers and secondary print servers extend the same footprint if left unpatched.
History, not attribution for this CVE: in 2023 the FBI and CISA reported that the Bl00dy Ransomware Gang exploited PaperCut CVE-2023-27350 on internet-exposed servers in the education sector, using the print-scripting interface to fetch remote-management software and, in some cases, proceeding to exfiltration and encryption (CISA AA23-131A). The 2026 flaws share the shape that drew that campaign.
Mitigation
Patch
Apply Emergency Patch Release 3 on every NG/MF Application Server, Site Server, and secondary or print server running v24, v25, or v26, even if Release 1 or 2 is already installed. Release 3 is cumulative and closes the bypasses that defeated the earlier releases. Match the build number, not just the version string.
| Product / branch |
Install to |
| PaperCut MF 26.x |
26.0.4 Build 76531 |
| PaperCut MF 25.x |
25.0.12 Build 76532 |
| PaperCut MF 24.x |
24.1.9 Build 76534 |
| PaperCut NG 26.x |
26.0.4 Build 76530 |
| PaperCut NG 25.x |
25.0.12 Build 76533 |
| PaperCut NG 24.x |
24.1.9 Build 76535 |
Version 23 and earlier have no patch; upgrade to a supported major version or take the server off the network. Sites that use an external database for card and ID lookups must re-enable it after patching, because Release 3 defaults the feature off:
# <install>/server/security.properties, then restart the Application Server
# Windows: C:\Program Files\PaperCut MF\server\security.properties
# Linux: /home/papercut/server/security.properties
security.card-number-lookup.enabled=Y
That line re-enables a feature the patch disables by default. It is not a mitigation, and it should be applied only where external card lookup is genuinely in use.
Configuration mitigation
The vendor's primary workaround is network restriction, to be applied now even where no suspicious activity has been seen: "If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only." Expressed as a Windows Defender Firewall rule on the Application Server (inferred implementation of the vendor's instruction; adapt the scope to your admin subnets):
# PaperCut web ports: 9191 (HTTP), 9192 (HTTPS)
New-NetFirewallRule -DisplayName 'PaperCut web - allow trusted only' -Direction Inbound -Protocol TCP -LocalPort 9191,9192 -RemoteAddress 10.10.0.0/16,10.20.0.15 -Action Allow
New-NetFirewallRule -DisplayName 'PaperCut web - block others' -Direction Inbound -Protocol TCP -LocalPort 9191,9192 -Action Block
PaperCut also offers an "Allowed admin IP addresses" list under Options > Advanced > Security. Treat it as defence in depth alongside the firewall rule, not instead of it: the bypass reaches administrative components through public page routes, so an application-layer admin allow-list is not a substitute for keeping the interface off untrusted networks.
Compensating controls
- Keep the management interface off the public internet entirely. Exposure is the precondition for the mass-scanning that is driving observed exploitation.
- Segment the print server away from directory, file, and backup infrastructure where the deployment allows, to blunt the pivot the blast radius describes.
- Preserve
server/logs, reverse-proxy or WAF logs, and endpoint process trees before patching, because the observed payload deletes server.log to cover its tracks.
- If compromise is suspected, the vendor's guidance is to secure clean backups, rebuild the Application Server from scratch, restore a backup predating the suspicious activity, and run your incident-response process. A planted driver reference can persist through the patch, so inspect the external-lookup configuration even after updating.
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune the false positives before deploying to production.
Network and log signals
- Any HTTP request to the PaperCut admin interface (TCP 9191 HTTP, 9192 HTTPS) from outside your admin subnets or VPN, especially POSTs with no preceding successful admin login in
server.log. PaperCut and Huntress deliberately withhold the vulnerable request path, so key on source, not URI.
server.log strings the vendor lists as confirmed indicators: No suitable driver found for jdbc:no:x, Database error looking up cardID: VALUES CAST, DB URL: jdbc:derby:memory:pwn;create=true, and a card-lookup error containing a hex blob beginning cafebabe (a Java class delivered through the database utilities).- A
derby.log entry booting an in-memory Derby database you did not configure, for example a database directory named pwn. Huntress noted derby.log survives even when the attacker deletes server.log.
server.log missing, truncated, or reset mid-day on an Application Server. The observed payload deletes its own output and the server log; a gap is itself an indicator.- External card and ID lookup settings (JDBC driver class, DB URL, lookup SQL) changed outside a change window, or changed at all where nobody uses the feature.
pc-app.exe (Windows) or pc-app (Linux) spawning a shell, and the observed discovery sequence: whoami & ver, tasklist, nltest /dclist:, quser, then a PowerShell Invoke-WebRequest writing an executable into C:\ProgramData and running it.- A new Windows service named "Remote Access Service" running
SimpleService.exe from C:\ProgramData\JWrapper-Remote Access\, or an unexpected AnyDesk install on the PaperCut host. Both appeared about 20 minutes after first contact in the vendor's intrusion timeline.
- New outbound HTTPS from the PaperCut server to file-drop or remote-access download hosts. PaperCut normally talks only to your database, directory, mail, and print devices.
YARA
rule PaperCut_Dropped_Java_Class_Command_Exec_CVE_2026_82078
{
meta:
description = "Java .class that shells out and references PaperCut artifacts; the loader dropped into server/lib via the CVE-2026-81578 + CVE-2026-82078 chain. AI-generated starter rule, validate before deploying."
author = "CVE Brief"
date = "2026-09-02"
reference = "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"
reference2 = "https://www.huntress.com/blog/papercut-actively-exploited"
cve = "CVE-2026-82078"
cve_chain = "CVE-2026-81578"
confidence = "medium"
strings:
$exec1 = "java/lang/Runtime" ascii
$exec2 = "java/lang/ProcessBuilder" ascii
$exec3 = "getRuntime" ascii
$exec4 = "exec" ascii fullword
$sh1 = "cmd.exe" ascii nocase
$sh2 = "cmd /c" ascii nocase
$sh3 = "/bin/sh" ascii
$sh4 = "/bin/bash" ascii
$pc1 = "server.log" ascii
$pc2 = "data/content" ascii
$pc3 = "data\\content" ascii
$pc4 = "PaperCut" ascii
$pc5 = ".out" ascii
$del1 = "java/io/File" ascii
$del2 = "delete" ascii fullword
$del3 = "java/nio/file/Files" ascii
$jdbc1 = "java/sql/Driver" ascii
$jdbc2 = "jdbc:" ascii
condition:
uint32be(0) == 0xCAFEBABE
and filesize < 512KB
and (1 of ($exec1, $exec2) or ($exec3 and $exec4))
and 1 of ($sh*)
and (
2 of ($pc*)
or (1 of ($pc*) and 1 of ($del*))
or (1 of ($jdbc*) and 1 of ($del*))
)
}
Sigma
Process lineage is the highest-confidence, most durable signal, since pc-app.exe has no legitimate reason to spawn shells or discovery tools outside an administrator-authored print script.
title: PaperCut NG/MF Application Server Spawning Shell or Discovery Tool (CVE-2026-81578 / CVE-2026-82078)
id: 3e7230eb-af15-4fd2-9042-47f27a18f7f8
status: experimental
description: |
Detects the PaperCut NG/MF Application Server process (pc-app.exe) spawning a command shell, scripting host,
discovery utility, or an executable from ProgramData. PaperCut and Huntress observed this lineage after the
CVE-2026-81578 (pre-auth config change) + CVE-2026-82078 (unsafe driver class loading) chain. Adapted from
SigmaHQ rule 0934ac71-a331-4e98-a034-d49c491fbbcb (CVE-2023-27350).
references:
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://www.huntress.com/blog/papercut-actively-exploited
author: CVE Brief (AI-generated starter rule, validate before deploying)
date: '2026-09-02'
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
- attack.t1059.003
- attack.discovery
- attack.t1082
- cve.2026-81578
- cve.2026-82078
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\pc-app.exe'
selection_child_img:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\whoami.exe'
- '\tasklist.exe'
- '\nltest.exe'
- '\quser.exe'
- '\net.exe'
- '\net1.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\msiexec.exe'
- '\wmic.exe'
- '\bash.exe'
- '\wsl.exe'
selection_child_path:
Image|contains:
- '\ProgramData\'
- '\Users\Public\'
- '\Windows\Temp\'
- '\AppData\Local\Temp\'
selection_child_cli:
CommandLine|contains:
- 'whoami & ver'
- 'whoami&ver'
- 'Invoke-WebRequest'
- ' -OutFile '
- '/dclist'
filter_optional_print_script:
CommandLine|contains: '\server\custom\'
condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_*
fields:
- ParentImage
- ParentCommandLine
- Image
- CommandLine
- User
falsepositives:
- Administrator-authored print scripts or custom integrations that shell out from the Application Server
- PaperCut installers, upgrades, or support diagnostics run under the pc-app.exe process tree
- Endpoint agents that inject helper processes under service parents
level: high
A second file-event rule catches the dropped loader itself, since PaperCut ships its code in JARs and does not write loose .class files to server\lib:
title: Suspicious File Dropped in PaperCut Server lib or content Directory (CVE-2026-82078)
id: cfa667b2-05cc-4682-bf95-c2b31fc69388
status: experimental
description: |
Detects a Java .class created under PaperCut server\lib, or a .cmd/.out under server\data\content. PaperCut's
27 Aug 2026 advisory lists these as files written by CVE-2026-82078 exploitation. The class is delivered
hex-encoded through the card-lookup database utilities, loaded as a database driver, runs commands, and
deletes its output and server.log.
references:
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://www.huntress.com/blog/papercut-actively-exploited
author: CVE Brief (AI-generated starter rule, validate before deploying)
date: '2026-09-02'
tags:
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505
- cve.2026-82078
logsource:
category: file_event
product: windows
detection:
selection_class:
TargetFilename|contains|all:
- 'PaperCut'
- '\server\lib\'
TargetFilename|endswith: '.class'
selection_content:
TargetFilename|contains|all:
- 'PaperCut'
- '\server\data\content\'
TargetFilename|endswith:
- '.cmd'
- '.out'
- '.bat'
- '.ps1'
- '.exe'
- '.dll'
filter_optional_installer:
Image|contains:
- 'pcmf-setup'
- 'pcng-setup'
- '\msiexec.exe'
condition: (selection_class or selection_content) and not 1 of filter_optional_*
fields:
- Image
- TargetFilename
- User
falsepositives:
- PaperCut upgrades or vendor support patches that place files in server\lib
- Administrator-deployed custom JDBC drivers placed in server\lib as loose classes
- Legitimate reports or exports written to server\data\content (tune the extension list)
level: high
Rule notes
The process-creation rule and the whoami/tasklist/nltest/quser/Invoke-WebRequest sequence are drawn from PaperCut's advisory and Huntress's writeup, with structure adapted from SigmaHQ's 2023 PaperCut rule. The file-event and YARA rules are built from the vendor's dropped-file indicators plus Huntress's description of the class behaviour; the YARA string combination is inferred from that behaviour, not from a recovered sample, so treat a hit as a lead and expect tuning. No 2026 source publicly names the vulnerable request path, so there is deliberately no web-log path rule. None of these rules catch a configuration-only intrusion that never spawns a process or drops a class, such as the Derby table-dump variant, which is why the server.log and derby.log strings above matter. On Linux, change the parent to pc-app and swap the child list for sh, bash, curl, and wget.
References