A print server is easy to underrate until it becomes a code-execution bridge into the network. PaperCut NG/MF now has that exact problem: one bug can change configuration without authentication, and the next can turn controlled configuration into Java code execution.

TL;DR

  • PaperCut disclosed active exploitation of PaperCut NG/MF vulnerabilities on August 27, 2026, and published Emergency Patch Release 2 on August 28.
  • CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on August 31, 2026, with a September 14 remediation due date.
  • CVE-2026-81578 is the pre-authentication setup condition: unauthenticated requests can trigger administrative backend actions before access validation completes.
  • CVE-2026-82078 is the execution condition: unsafe dynamic class loading in database connector logic can execute Java bytecode already on the classpath if configuration can be manipulated.
  • Defenders should patch, restrict web access, and investigate exposed servers for PaperCut log tampering, suspicious database lookup errors, child shell processes from pc-app.exe, SimpleHelp installation, and unexpected AnyDesk deployment.

Why This Matters

PaperCut NG and MF often sit in schools, universities, public-sector offices, healthcare environments, and ordinary businesses where printing is still tied to identity, billing, card lookup, directory sync, and multifunction devices. That makes the server more than a print queue. It is an identity-adjacent management point that frequently talks to directories, databases, clients, and embedded device workflows.

PaperCut’s own bulletin says the company is investigating confirmed customer incidents. That is the line that changes this from patch hygiene to incident response. A patched server may still have been accessed before the patch. An internet-facing server should be treated as potentially touched until logs and endpoint telemetry say otherwise.

The Attack Chain

The two CVEs matter most as a chain.

CVE-2026-81578 is an authentication-bypass issue in the web management interface. Under specific conditions, unauthenticated remote requests can reach administrative backend actions before access checks finish. On its own, that means configuration integrity is no longer trustworthy.

CVE-2026-82078 is unsafe dynamic class loading in database connection utilities. PaperCut describes the bug as database driver classes being instantiated from configurable driver names without an allowlist of approved drivers. If an attacker can alter the relevant configuration, arbitrary Java bytecode present on the application classpath can run under the PaperCut server process.

The practical chain is therefore:

Internet-reachable PaperCut web interface
        -> unauthenticated configuration manipulation
        -> database connector points at attacker-controlled class behavior
        -> Java code executes in the PaperCut server context
        -> post-exploitation tooling runs from the print server

That is not a novelty exploit pattern. It is the same management-plane failure defenders keep seeing across RMM, MFT, CI/CD, and gateway software: a trusted operational tool gets exposed, a pre-auth bug crosses the boundary, and attackers inherit the tool’s position in the network.

What PaperCut Says To Do

PaperCut’s immediate guidance is blunt: if the PaperCut NG/MF Application Server is reachable from the public internet, restrict web access to trusted IP addresses only. Use firewall rules, network controls, or an equivalent measure even before suspicious activity is observed.

Emergency Patch Release 2 is the key patch level. PaperCut recommends Release 2 even for customers who already installed the original emergency patch, because Release 2 includes additional hardening. The emergency patch is available for PaperCut MF and NG v24, v25, and v26. PaperCut lists all versions of PaperCut NG and PaperCut MF as potentially impacted, and recommends customers on older versions move to a supported patched release path.

The Canadian Centre for Cyber Security, NCSC-NL, and CISA have all echoed the urgency. CISA’s KEV entry means the vulnerabilities meet CISA’s threshold for known exploitation in the wild. It does not mean every exposed server is compromised, and it also does not mean non-U.S. organizations can ignore the deadline. KEV is a prioritization signal defenders should use even outside federal environments.

Detection And Triage

Start with the PaperCut Application Server. Do not stop at version checks.

Look for missing, truncated, or deleted PaperCut server.log files. PaperCut specifically calls this out as suspicious because attackers often clean up after initial execution.

Search server.log for database lookup and driver errors connected to the exploit path:

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
DB URL: jdbc:derby:memory:pwn;create=true
Database error looking up cardID: VALUES CAST(X'cafebabe
DB URL: jdbc:no:x DB Driver: <5-char random name>

Check the PaperCut installation paths for short random class or command/output files:

<install>\server\lib\<5-char-name>.class
<install>\server\data\content\<5-char-name>.cmd
<install>\server\data\content\<5-char-name>.out

Absence of those files does not clear the host. PaperCut notes they may be removed as activity continues.

On Windows, investigate child processes launched by pc-app.exe. PaperCut’s observed activity included cmd.exe execution, basic discovery commands such as whoami, ver, tasklist, nltest /dclist:, quser, and directory listing under C:\Users. Where endpoint protection did not stop the chain, PaperCut observed remote-access tooling staged from C:\ProgramData, including a Windows service named Remote Access Service running SimpleHelp’s SimpleService.exe, and an unexpected AnyDesk download.

For a SOC, useful hunts include:

  • pc-app.exe or pc-app spawning cmd.exe, powershell.exe, or scripting interpreters.
  • PaperCut server processes writing .class, .cmd, or .out files under server library or content directories.
  • New services named Remote Access Service, especially pointing to JWrapper-Remote Access.
  • Unexpected AnyDesk, SimpleHelp, remote tunnel, or remote administration binaries on the PaperCut server.
  • Network egress from the PaperCut server to file-sharing, remote-access, or newly observed domains shortly after suspicious PaperCut log entries.

Hardening Beyond The Patch

Patch Release 2 closes the known vulnerability path. It does not fix the deployment pattern that made the path reachable.

The administrative web interface should not be public. Put it behind VPN, private access, a bastion, or strict source IP allowlists. If remote printing or embedded device workflows require external connectivity, separate those paths from administrator access instead of exposing the whole application.

Treat PaperCut as a tiered management asset. Limit where the server can connect, what credentials it can reach, and which systems accept traffic from it. If it talks to an external database for Card/ID lookup, review that configuration carefully after patching, because the exploit chain specifically touches database connector behavior.

Finally, add PaperCut to the same monitoring category as RMM and MFT software. It is not just “printing.” It is an operational server with privileged workflow access, and attackers have now shown they are willing to use it that way.

What You Can Do Today

  1. Confirm whether any PaperCut NG/MF Application Server is reachable from the public internet.
  2. Restrict web access to trusted IP ranges immediately, before waiting for a maintenance window.
  3. Install Emergency Patch Release 2 for the supported v24, v25, or v26 release line.
  4. For older deployments, plan an upgrade to a supported patched version rather than treating an unsupported server as acceptable risk.
  5. Preserve and review PaperCut logs before rotation or cleanup removes evidence.
  6. Hunt for PaperCut-provided IOCs, pc-app.exe child processes, suspicious services, and remote-access tooling.
  7. If compromise is suspected, rotate credentials reachable from the PaperCut server and review downstream trust paths.

Sources