PaperCut, a widely used print management software, has confirmed active exploitation of a pre-authentication remote code execution vulnerability in its servers, with nearly half of tracked installations remaining unpatched. The flaw, which affects schools, hospitals, and offices globally, was confirmed by PaperCut on August 27, following observations of real-world attacks.
Security researchers at Huntress identified evidence of exploitation in two customer environments and successfully reproduced the full attack chain against an unpatched PaperCut NG 25.0.11.75758 server. The observed attacks involved system discovery, with attackers running basic commands like `whoami`, `ver`, and `tasklist` to identify compromised accounts, Windows versions, and running processes. While no secondary malware, command-and-control traffic, or deeper persistence was observed, these activities are characteristic of reconnaissance preceding more significant operations.
The vulnerability, tracked as CVE-2026-81578, stems from an authorization bypass where PaperCut incorrectly checks permissions for the displayed page rather than the action being performed. This allows an unauthenticated attacker to modify server configurations. This initial flaw can then be chained with a second vulnerability, CVE-2026-82078, found in PaperCut's database utilities. This second flaw enables the loading of unsafe Java classes, permitting attackers to execute arbitrary Java code on the server.
During their investigation, forensic analysis revealed a malicious Java class file dropped directly into PaperCut's installation directory. This file was designed to execute commands, write results to a temporary file, and then delete both the output and the server's `server.log` file to obscure its tracks. However, a `Derby` database log entry, specifically `memory:...\pwn`, survived the cleanup, which PaperCut's own guidance now identifies as a high-confidence indicator of compromise. The `server.log` file also contained a log line with the string `DB URL: jdbc:derby:memory:pwn` immediately following the appearance of a large encoded data blob, indicating execution of the malicious code.
Huntress researchers successfully demonstrated the exploit in a test environment, achieving unauthenticated remote code execution. This resulted in PaperCut's `pc-app.exe` Application Server launching `charmap.exe` with `SYSTEM` privileges, confirming the potential for the highest level of privilege escalation on Windows systems.
PaperCut's patching process has been complex, with an emergency patch initially released, followed by another update less than 24 hours later after further testing. Fixes for version 24 were still under development when the report was published, and one of the confirmed attacks targeted a server running version 24 before a patch for that specific version was available.
A significant concern highlighted by Huntress is that approximately 47% of the 2,500 PaperCut installations they monitor are running version 23 or earlier, for which no patches are currently available. For organizations operating these older versions, the immediate recommendation is to remove the PaperCut Application Server from public internet access, restricting access via a VPN or trusted internal network until a proper fix becomes available.
Organizations that have had publicly accessible PaperCut servers recently are advised that installing patches should be the beginning of a thorough investigation. Before restarting servers, logs and configuration files should be preserved. Defenders should look for instances where `pc-app.exe` has launched command shells or tools like `tasklist`, and check for unexpected `.class` files within the server's `lib` directory, as even brief reconnaissance attempts could signal a more serious impending attack.
