PaperCut, the company behind print management software used by schools, hospitals, and government agencies around the world, confirmed on August 27, 2026 that two vulnerabilities in its NG and MF products were being actively exploited by attackers. The company has since pushed out a second round of emergency patches after researchers found ways around the first fix.
The two flaws work together. The first, tracked as CVE-2026-81578 and rated 8.8 out of 10 in severity, is a weakness in how PaperCut’s web management interface checks who is allowed to do what. It lets someone send a request without logging in and have it treated as if it came from an authorized administrative function. The second, CVE-2026-82078, rated 9.4, sits in the part of PaperCut that loads database driver software. Once an attacker gets past the access check, this flaw lets them tell the server to load and run arbitrary Java code. Chained together, the two bugs give an attacker full remote code execution on a PaperCut server without ever needing a username or password.
Security firm Huntress said it spotted exploitation attempts as early as August 26, a day before PaperCut’s public bulletin, and confirmed the technique was used against at least two of its customers. In one case, the entire intrusion lasted under two minutes. Attackers ran basic reconnaissance commands such as whoami and tasklist, encoded in base64, and dropped hex-encoded Java class files into the server’s library folder. Huntress said it found no evidence of malware, backdoors, or ransomware being installed in the incidents it observed, describing the activity so far as focused on scouting compromised systems rather than causing damage.
PaperCut said it was “aware of confirmed customer incidents” but characterized the attacks as limited and targeted, and it has not named any victims or identified who is responsible. A separate research team, watchTowr, independently reproduced the vulnerability chain and discovered that PaperCut’s first emergency patch could still be bypassed, along with a related authentication weakness the company had not addressed. That finding forced PaperCut to ship a second emergency patch with additional hardening on August 28.
The vulnerable versions are PaperCut NG and MF 24, 25, and 26, running on Windows, Linux, or macOS, covering both primary site servers and secondary print servers. Version 23 and earlier do not receive a patch at all. PaperCut is telling those customers to upgrade instead. That is a significant gap: Huntress says that of roughly 2,500 PaperCut installations it tracks, 47 percent are still running version 23 or older, meaning nearly half the installations it can see have no patch available to them yet.
Researchers have also flagged how many of these servers can be reached directly from the internet. SecurityWeek reported that around 1,000 PaperCut instances are currently internet-facing, most of them located in North America and Europe, making them the most immediate pool of potential targets.
What administrators should do now
PaperCut and the researchers tracking the attacks recommend applying both the first and second emergency patches, not just one. Where immediate patching is not possible, administrators are advised to restrict access to the PaperCut Application Server to trusted IP addresses using firewall rules, so the management interface is not reachable from the open internet. Huntress has also published signs of compromise to check for, including unexpected .class files inside the server’s lib folder, matching files in the server’s data and content directories, database log entries referencing “jdbc:derby:memory:pwn”, and server log files that are missing or unexpectedly short.
This is not the first time PaperCut software has drawn attention from attackers. A critical flaw disclosed in 2023, tracked as CVE-2023-27350, was exploited by ransomware affiliates and state-linked hacking groups to break into corporate networks, underscoring how quickly attackers move once a PaperCut vulnerability becomes public.
Source: The Hacker News, with additional reporting from BleepingComputer, SecurityWeek, and Huntress.
