Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers are actively chaining two vulnerabilities in PaperCut NG and MF to achieve unauthenticated remote code execution without needing credentials CVE-2026-81578 (CVSS 8.8) is an improper access control flaw allowing authentication bypass, while CVE-2026-82078 (CVSS 9.4) enables unsafe dynamic class loading for arbitrary Java code execution Huntress and watchTowr have observed limited but confirmed exploitation, with attackers deploying OS-agnostic Java .class files for reconnaissance and lo
Analysis
TL;DR
- Attackers are actively chaining two vulnerabilities in PaperCut NG and MF to achieve unauthenticated remote code execution without needing credentials
- CVE-2026-81578 (CVSS 8.8) is an improper access control flaw allowing authentication bypass, while CVE-2026-82078 (CVSS 9.4) enables unsafe dynamic class loading for arbitrary Java code execution
- Huntress and watchTowr have observed limited but confirmed exploitation, with attackers deploying OS-agnostic Java .class files for reconnaissance and log cleanup
- PaperCut released a second emergency patch with additional hardening, but new patch bypasses affecting the fully patched version have also been identified
- Organizations are urged to immediately remove public exposure of PaperCut instances, apply patches, and hunt for indicators of compromise in logs
Why It Matters
This incident highlights the critical risk of chaining multiple medium-severity vulnerabilities to achieve high-impact outcomes like unauthenticated RCE, a pattern increasingly common in supply-chain-adjacent attacks. PaperCut's widespread deployment in enterprise environments—often internet-facing—makes it an attractive pivot point for attackers seeking initial access to corporate networks and sensitive printed document data.
Technical Details
- CVE-2026-81578 (CVSS 8.8): An improper access control vulnerability in PaperCut's web management interface where unauthenticated requests can trigger administrative backend actions before access validation checks complete, effectively bypassing authentication
- CVE-2026-82078 (CVSS 9.4): An unsafe dynamic class loading vulnerability in database connection utilities where the application instantiates database driver classes based on configurable driver names without validating against an allowlist, enabling arbitrary Java code execution within the application process
- Attack chain: Attackers first exploit CVE-2026-81578 to bypass authentication and modify server configuration files, then leverage CVE-2026-82078 by pointing the driver configuration to a malicious class to achieve remote code execution
- Post-exploitation artifacts: Attackers deployed a Java .class file that runs OS-agnostic commands (e.g., "whoami & ver", "whoami & ver & tasklist") to fingerprint the target, writes output to "/data/content/Udydn.out", then deletes the output file along with "server.log" and "/data/internal/derby.log" to cover tracks
- Patch bypasses: watchTowr discovered multiple patch bypasses and an additional authentication bypass vulnerability; one was remediated in the second emergency patch, but new bypasses affecting the latest fully patched version have since been identified
Industry Insight
- The discovery of patch bypasses on the latest fully patched version underscores the importance of defense-in-depth; organizations should not rely solely on patching but also restrict PaperCut's network exposure through VPNs, IP allowlisting, and network segmentation
- PaperCut's dual role as an internet-facing entry point and a repository of sensitive printed document data makes it a high-value target; proactive log monitoring for indicators like "Database error looking up cardID: VALUES CAST" should be part of any incident response playbook
- The chaining pattern observed here—using an access control flaw to modify configuration and then exploiting unsafe dynamic loading—serves as a cautionary template for auditing other enterprise applications that accept configurable driver or class names without strict allowlisting
Disclaimer: The above content is generated by AI and is for reference only.