Threat actors are actively exploiting two vulnerabilities in PaperCut NG and PaperCut MF that can be chained to bypass authentication and achieve remote code execution on vulnerable PaperCut Application Servers.
Tracked as CVE-2026-81578 and CVE-2026-82078, the vulnerabilities affect PaperCut’s web management and database connection functionality. CVE-2026-81578 carries a CVSS v4.0 score of 8.8 (High), while CVE-2026-82078 is rated 9.4 (Critical).
Vulnerability Overview
The attack chain combines two separate vulnerabilities.
| CVE | Vulnerability | CVSS |
| CVE-2026-81578 | Authentication bypass / improper access control | 8.8 High |
| CVE-2026-82078 | Unsafe dynamic class loading | 9.4 Critical |
Individually, CVE-2026-81578 provides the attacker with the ability to manipulate privileged PaperCut configuration without authentication.
CVE-2026-82078 requires the ability to manipulate configuration parameters, but once that condition is met it can be used to load attacker-controlled Java bytecode.
Chaining the two vulnerabilities removes the authentication requirement from the second vulnerability and results in pre-authentication remote code execution.
CVE-2026-81578 Authentication Bypass
CVE-2026-81578 affects authorization enforcement within the PaperCut NG/MF web management interface.
A specially crafted request can cause PaperCut to render one page while invoking a component or action associated with another.
The authorization mechanism can consequently validate access based on the rendered page rather than the permissions required by the underlying component.
An unauthenticated attacker can abuse this discrepancy to invoke administrative functionality and modify sensitive server configuration.
PaperCut classifies the issue as a missing authentication/improper access control vulnerability and states that unauthenticated remote requests can trigger backend administrative actions before access-validation checks have completed.
On its own, this provides unauthorized configuration modification.
The critical impact appears when it is chained with CVE-2026-82078.
CVE-2026-82078 Unsafe Dynamic Class Loading
CVE-2026-82078 exists in PaperCut’s database connection utilities.
PaperCut allows database driver classes to be selected using configurable driver names. Vulnerable versions do not sufficiently restrict these values to a known allowlist of approved classes.
As a result, an attacker capable of manipulating the relevant configuration can cause PaperCut to instantiate arbitrary Java classes already placed on the application’s classpath.
PaperCut describes the vulnerability as CWE-470: Use of Externally-Controlled Input to Select Classes or Code, commonly referred to as unsafe reflection or dynamic class loading.
The resulting Java bytecode executes under the security context of the PaperCut Application Server.
During testing on Windows, successful exploitation resulted in an arbitrary process being launched as SYSTEM underneath the pc-app.exe PaperCut process.
How the Exploit Chain Works
At a high level, the attack can be divided into four stages.
1. Authentication Is Bypassed
The attacker sends a specially crafted unauthenticated request to the PaperCut management interface.
CVE-2026-81578 causes PaperCut to authorize the request incorrectly, allowing privileged administrative actions to be invoked without valid authentication.
2. PaperCut Configuration Is Modified
The attacker modifies configuration relating to PaperCut’s database lookup functionality.
This gives the attacker control over parameters later consumed by PaperCut’s database connector.
3. Malicious Java Code Is Introduced
During observed exploitation, attackers supplied encoded Java .class files that were written beneath the PaperCut installation directory.
Malicious classes included:
Udydn.class
and:
Moo97.class
under the PaperCut server/lib directory.
The malicious Java class acted as a bridge between PaperCut and the underlying operating system.
4. Arbitrary Commands Are Executed
CVE-2026-82078 causes PaperCut to dynamically load the attacker-controlled class.
The malicious class can then execute operating-system commands, write results to PaperCut’s data directories and remove artifacts after execution.
This transforms the authentication bypass and configuration manipulation into full remote code execution.
Active Exploitation
This attack chain is being exploited in real-world environments.
Exploitation can be reproduced against a standard installation of PaperCut NG 25.0.11.75758.
Early attacker activity focused heavily on reconnaissance.
Recovered commands included:
whoami & ver
and:
whoami & ver & tasklist
These commands allow attackers to determine the compromised account context, Windows version and running processes.
PaperCut has since published evidence of a broader post-exploitation sequence involving:
- system and account discovery;
- process enumeration;
- domain-controller discovery;
- enumeration of logged-in users and user directories;
- downloading additional remote-access software;
- creation of persistent remote-management services.
Observed commands included utilities such as:
tasklist
nltest /dclist:
quser
and PowerShell-based file downloads.
SimpleHelp and AnyDesk Deployed After Compromise
PaperCut’s investigation has identified attackers deploying legitimate remote-management software following exploitation.
In one documented sequence, attackers downloaded and silently installed SimpleHelp, which created a Windows service named:
Remote Access Service
running:
C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
The service was configured to run as LocalSystem and automatically start with Windows.
Approximately six minutes later, the attackers also downloaded AnyDesk to:
C:\ProgramData\AnyDesk.exe
providing another potential remote-access mechanism.
The deployment of legitimate remote administration software is important from a defensive perspective because these tools may not be detected as traditional malware.
Organizations should therefore validate whether any SimpleHelp or AnyDesk installations observed on PaperCut servers are explicitly authorized.
At the time of writing, PaperCut has not attributed the attacks to a specific threat actor, and CISA lists known ransomware campaign use as unknown.
Attackers Attempt to Remove Evidence
An analyzed Java payload ncluded functionality designed to clean up after command execution.
The recovered class wrote command output into PaperCut’s server/data/content directory before deleting the output and command files.
More importantly, the payload was also observed deleting PaperCut’s:
server.log
file after execution.
This explains why PaperCut specifically warns administrators to investigate unexpectedly missing, truncated or deleted server.log files.
The absence of obvious PaperCut logs should therefore not be interpreted as evidence that exploitation did not occur.
Second Emergency Patch Required
PaperCut initially released emergency updates on August 28.
However, further investigation identified additional weaknesses and methods capable of bypassing the initial protections.
PaperCut subsequently released Emergency Patch Release 2 and recommends installing it even on systems where the first emergency patch was already applied.
The second emergency release is available for PaperCut NG and MF major versions:
- 24
- 25
- 26
on Windows, Linux and macOS.
Organizations running version 23 or earlier should upgrade to a supported release rather than wait for a dedicated patch.
Site Servers and secondary/print servers should also be updated. PaperCut states that Print Deploy and Mobility Print are not affected by these vulnerabilities.
Affected and Fixed Versions
The current CVE records identify PaperCut MF/NG versions before the following release lines as affected:
| Branch | Fixed Version |
| PaperCut NG/MF 24 | 24.1.10 |
| PaperCut NG/MF 25 | 25.0.13 |
| PaperCut NG/MF 26 | 26.0.5 |
At the time of writing, PaperCut’s urgent security bulletin continues to direct customers toward Emergency Patch Release 2 while its normal release process is being completed.
Administrators should therefore use PaperCut’s security bulletin as the authoritative source for the latest available build for their deployment.
Public Exploit Availability
The likelihood of broader exploitation is increased by the availability of public tooling.
A Metasploit module is now available for the PaperCut vulnerability chain, allowing the issue to be reproduced against vulnerable systems.
Combined with inclusion in CISA’s KEV Catalog and confirmed exploitation in customer environments, organizations should assume that internet-facing vulnerable PaperCut servers are at significant risk of automated scanning and exploitation.
Indicators of Compromise
Organizations should investigate PaperCut Application Servers for the following activity.
Suspicious PaperCut Log Entries
PaperCut specifically identifies:
ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
Additional suspicious strings include:
DB URL: jdbc:derby:memory:pwn;create=true
Database error looking up cardID: VALUES CAST(X’cafebabe
Database error looking up cardID: VALUES CAST(‘
and database-driver entries following the pattern:
DB URL: jdbc:no:x DB Driver: <5-character random name>
Suspicious Files
Look for unexpected files matching patterns such as:
<PaperCut>\server\lib\<5-character-name>.class
<PaperCut>\server\data\content\<5-character-name>.cmd
<PaperCut>\server\data\content\<5-character-name>.out
Pay particular attention to:
Udydn.class
and:
Moo97.class
from compromised systems.
Attackers may remove these files following execution, so their absence does not rule out compromise.
Suspicious Process Activity
Investigate instances where:
pc-app.exe
or the corresponding PaperCut Java process launches:
- cmd.exe
- powershell.exe
- whoami.exe
- tasklist.exe
- nltest.exe
- other unexpected administrative or discovery utilities.
A PaperCut server process unexpectedly spawning a command shell should be treated as highly suspicious.
Log Tampering
Investigate:
- deleted server.log files;
- unexpectedly truncated logs;
- suspicious gaps in PaperCut logging;
- irregular Derby database entries around the same time.
Huntress identified Derby database references containing:
memory:…\PaperCut MF\server\data\internal\pwn
immediately before code execution in one compromise.
Remote Access Software
Search affected PaperCut servers for unexpected installations of:
- SimpleHelp
- AnyDesk
Particularly investigate a Windows service named:
Remote Access Service
pointing to:
C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
and unexpected:
C:\ProgramData\AnyDesk.exe
files.
Recommended Mitigation and Response
1. Patch PaperCut Immediately
Install the latest PaperCut-supported security update for all PaperCut NG and MF Application Servers.
Systems using major versions 24, 25 or 26 should at minimum have Emergency Patch Release 2 or a later vendor-approved fixed build installed.
Do not assume the original emergency patch provides sufficient protection.
Organizations running version 23 or earlier should upgrade to a currently supported release.
2. Remove PaperCut Management Interfaces From the Public Internet
PaperCut strongly recommends restricting access to its Application Server web interfaces to trusted IP addresses.
Use:
- firewall allowlists;
- network access controls;
- VPN access;
- dedicated administrative networks;
- approved management jump hosts.
This action should be taken even when patching has already been completed.
3. Investigate Previously Exposed Systems
Because exploitation occurred before patches became available, organizations should not treat patch installation alone as sufficient incident closure.
Any PaperCut Application Server that was publicly accessible while running a vulnerable version should be reviewed for previous exploitation.
Preserve relevant evidence before upgrades or restarts where possible, including:
- PaperCut logs;
- endpoint telemetry;
- configuration files;
- process trees;
- firewall and reverse-proxy logs;
- DNS and network-flow telemetry;
- recently created services;
- scheduled tasks;
- recently created files.
4. Hunt for PaperCut-Spawning Shells
Use EDR or process telemetry to identify command interpreters or discovery utilities spawned by pc-app.exe.
Particularly prioritize:
pc-app.exe → cmd.exe
and:
pc-app.exe → powershell.exe
along with unexplained discovery commands such as whoami, tasklist, nltest or quser.
5. Review Remote Administration Software
Determine whether SimpleHelp, AnyDesk or other RMM software is legitimately deployed on PaperCut systems.
Unauthorized RMM installations should be treated as evidence of potential compromise rather than simply removed without further investigation.
Stay Safe. Stay Secure.
OP Innovate Research Team
