PaperCut Releases Second Emergency Patch for Exploited Flaws — US Businesses at Risk

Introduction

PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes.

This is a critical security alert for US businesses that rely on PaperCut for print management across their organizations. The vulnerabilities allow unauthenticated attackers to bypass authentication and execute arbitrary code on affected servers.

The Two Vulnerabilities: CVE-2026-81578 & CVE-2026-82078

PaperCut has now shared technical details and CVE identifiers for the two vulnerabilities being exploited in the wild.

CVE-2026-81578 — Authentication Bypass (CVSS 8.8 — High Severity)

• Affects the PaperCut NG/MF web management interface
• Allows unauthenticated remote attackers to trigger administrative functions before access validation checks are completed
• Can be chained with the second vulnerability for full remote code execution

CVE-2026-82078 — Unsafe Dynamic Class-Loading Flaw (CVSS 9.4 — Critical)

• Exists in PaperCut's database connection utilities
• Allows manipulation of system configuration parameters
• Enables execution of arbitrary Java bytecode under the security context of the PaperCut server process
• Critical rating (9.4) due to the potential for complete system compromise

Why PaperCut Released a Second Emergency Patch

On Friday, PaperCut released Emergency Patch Release 2, an updated security fix that includes additional hardening developed after further analysis with its internal security team and researchers at Huntress and watchTowr.

Why a second patch was necessary:

• Multiple patch bypasses discovered — Researchers found ways to circumvent the original emergency fixes
• Additional authentication bypass vulnerability — watchTowr identified another bypass that needed addressing
• Full RCE chain reproduction — Huntress reproduced the full pre-authentication RCE chain and shared findings with PaperCut

Huntress's Findings

Huntress, which has been working closely with PaperCut during the incident, reported:

• Observed exploitation in two customer environments
• Reproduced the full pre-authentication RCE chain
• Found hex-encoded Java .class files in logs acting as an RCE bridge between PaperCut and the underlying operating system
• Committed executed by attackers appeared to be for reconnaissance rather than malware deployment or persistence establishment
• Discovered multiple bypasses for the original emergency patches

Who Is Affected?

Affected Versions:

• PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS
• Version 23 and earlier — customers are advised to upgrade to the latest version rather than wait for a patch

Components That Need Updating:

• Main PaperCut servers — must be patched immediately
• Site Servers — must also be upgraded to patched versions
• Secondary/print servers — must be upgraded

Components NOT Affected:

• Print Deploy — not affected
• Mobility Print — not affected

What US Businesses Need to Do Immediately

US IT administrators must take these steps immediately:

1. Apply Emergency Patch Release 2

• Even if you applied the first patch, you must install Release 2
• The first patch had bypasses that attackers can exploit
• Release 2 includes additional hardening

2. Restrict Web Interface Access

• Use firewall rules to restrict access to the web interfaces
• Implement network access controls (NAC)
• Only allow trusted IP addresses to access PaperCut web interfaces

3. Check for Indicators of Compromise

• Monitor for suspicious post-exploitation activity from the pc-app.exe process
• Check for missing or truncated server.log files
• Look for the following errors in server.log:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Indicators of Compromise (IOCs)

PaperCut advises customers to watch for the following signs of compromise:

• Suspicious activity from pc-app.exe — monitor for unusual process behavior
• Missing or truncated server.log files — attackers may attempt to cover their tracks
• Specific error messages in server.log:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
• Hex-encoded Java .class files in logs — these act as an RCE bridge
• Intrusion-detection or endpoint alerts tied to the PaperCut Application Server

Historical Context: PaperCut's History of Exploitation

This is not the first time PaperCut has been targeted by attackers.

In 2023, attackers began exploiting CVE-2023-27350, an authentication bypass and remote code execution vulnerability in PaperCut. Those attacks were ultimately linked to numerous threat actors, including:

• Clop ransomware gang — one of the most prolific ransomware operations
• LockBit ransomware gang — the most active ransomware group in 2023
• Iranian state-backed hacking groups — nation-state actors targeting US businesses
• Bl00dy Ransomware Gang — a ransomware operation targeting education and healthcare

Final Thoughts

The exploitation of PaperCut's CVE-2026-81578 and CVE-2026-82078 vulnerabilities represents a significant threat to US businesses. With attackers actively targeting vulnerable servers and researchers discovering bypasses for the initial patches, the window to secure PaperCut servers is closing rapidly.

Key takeaways for US organizations:

• Two PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) are being actively exploited
• Emergency Patch Release 2 is available and must be applied immediately — even if you applied the first patch
• Versions 24, 25, and 26 are affected; version 23 users should upgrade
• Restrict web interface access to trusted IP addresses
• Monitor for IOCs including suspicious pc-app.exe activity and specific error messages
• Historical precedent — ransomware gangs and nation-state actors have exploited PaperCut before

If you need help securing your PaperCut environment or want to learn more about protecting your US business from cyber threats, contact SystemLogicIT for a free security assessment.