A critical vulnerability in PaperCut NG and MF print management software, identified as CVE-2026-81578, was actively exploited in the wild at least one day before its public disclosure on August 28, 2026. The flaw, categorized as a missing authentication for a critical function (CWE-305), carries a CVSS score of 9.8, indicating its severe impact.
The vulnerability allows unauthenticated remote attackers to modify certain system configurations through the web management interface. This is possible because, under specific conditions, unauthenticated requests targeting administrative functions can trigger backend actions before access validation checks are fully completed.
Evidence of exploitation first appeared on August 27, 2026, when the European Union Agency for Cybersecurity (ENISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) followed suit on August 31, 2026, also listing it in their KEV catalog.
PaperCut issued an urgent security advisory on August 27, 2026, detailing the vulnerability and providing mitigation instructions. CISA has mandated that federal agencies apply these mitigations by September 14, 2026, in accordance with their Binding Operational Directive 26-04.
Further reports indicate that attackers are exploiting CVE-2026-81578, often in conjunction with another flaw, CVE-2026-82078, to compromise education sector organizations in the U.S. and Europe. These attacks aim to steal credentials and gain privileged access. Arctic Wolf researchers have observed this exploit chain being used for command execution and reconnaissance.
PaperCut released a second emergency patch to address both CVE-2026-81578 and CVE-2026-82078, as initial fixes were found to be bypassable. The company strongly advises all customers to install the latest patch, even if they had applied previous updates, and to implement network access controls as an additional precautionary measure.
