Two severe vulnerabilities in PaperCut NG and MF have been exploited in the wild, allowing unauthenticated attackers to gain full remote code execution (RCE) by chaining them together. The vendor released an urgent patch with enhanced security measures after researchers discovered the exploit method. These kind of flaws pose major risks as they open doors into enterprise environments with a widely used print management tool.
The Threat: CVE-2026-82078 & CVE-2026-81578
The first flaw, tracked as CVE-2026-82078 (CVSS 9.4), involves unsafe dynamic class loading in PaperCut’s database utilities component. Attackers were able to have PaperCut instantiate database drivers based on user-specified driver names without checking them against an allowlist. This lets an attacker load arbitrary classes, potentially injecting malicious code. The second vulnerability, CVE-2026-81578 (CVSS 8.8), resides in the web management interface. Under specific conditions, attackers can trigger backend administrative functions via unauthorized remote requests before access control checks are applied.
How Attackers Are Exploiting the Chain
Black hats are leveraging these two bugs in tandem to bypass authentication entirely. The process begins with making an unauthenticated request that supplies a crafted payload referencing one page that’s rendered and another page containing the target component or action. Because PaperCut’s authorization mechanism incorrectly trusts the rendered page context, it misses validating permissions for the actual component. This misuse lets attackers change server configuration settings, hit sensitive endpoints, and ultimately execute code under the application’s process.
Observed exploit activity includes running Base64-encoded commands such as “whoami & ver” to identify the operating system and privilege levels. Attackers have also dropped a Java .class file that’s OS-agnostic, which runs these commands and grabs directory listings, putting the output in a file called Udydn.out. Later stages of the exploit clean up traces by deleting Udydn.out, server logs, and internal Derby logs. A variant of the payload seen on August 27, 2026 even adds a “tasklist” command to gather running processes.
Mitigation & Recommendations
PaperCut issued a follow-up emergency patch that adds hardening beyond the first fix. Organizations using PaperCut NG or MF need to apply this revised patch immediately. If the application is exposed to the internet, public access should be removed or placed behind a VPN or similar protected administrative network path. Restricting web management interfaces to known IPs is also advised.
Security teams should search logs for anomalies typified by database error messages regarding “Database error looking up cardID” and similar access log entries, which may indicate past exploit attempts or successful attacks.
This incident illustrates how attackers can chain vulnerabilities across layers—authorization and unsafe component loading—to achieve RCE without ever needing valid credentials. It underscores the urgency of defense-in-depth, patch hygiene, and minimizing exposure of administrative interfaces. Moving forward, visibility into dependency loading, rigorous access checks, and staging fixes with threat modeling will be essential to prevent similar attacks.
