PaperCut has issued a second emergency security update for its NG and MF print management software, addressing two actively exploited vulnerabilities after researchers identified multiple methods to bypass the initial fixes. The company had previously released an emergency patch for PaperCut NG/MF versions 25 and 26, warning of zero-day exploitation, but initially withheld technical details and CVE identifiers.
The vulnerabilities are now tracked as CVE-2026-82078 and CVE-2026-81578. When chained, these flaws allow unauthenticated attackers to bypass authentication and achieve remote code execution on vulnerable servers. CVE-2026-81578 is an authentication bypass vulnerability with a severity rating of 8.8, affecting the PaperCut NG/MF web management interface. It enables unauthenticated remote requests to trigger backend administrative actions before access validation is complete.
The second vulnerability, CVE-2026-82078, is a critical unsafe dynamic class-loading flaw rated 9.4, found in PaperCut's database connection utilities. This flaw allows the application to load database driver classes based on configurable names without proper validation against an approved allowlist. If an attacker can manipulate system configuration parameters, this can lead to the execution of arbitrary Java bytecode on the application classpath under the security context of the PaperCut server process.
The "Emergency Patch Release 2" was developed following further analysis by PaperCut's internal security team and external researchers from Huntress and watchTowr. WatchTowr, which has been collaborating with PaperCut, confirmed that its researchers successfully reproduced the vulnerabilities, discovered several patch bypasses, and identified an additional authentication bypass vulnerability. Huntress also reported observing exploitation in two customer environments and successfully reproducing the full pre-authentication remote code execution chain.
Huntress indicated that PaperCut logs captured reconnaissance commands used by attackers, along with hex-encoded Java `.class` files that functioned as an RCE bridge, facilitating command execution and file manipulation between PaperCut and the underlying operating system. The observed commands appeared to focus on reconnaissance rather than malware deployment or establishing persistence. Huntress also shared its findings regarding multiple bypasses for the original emergency patches and an additional authentication bypass vulnerability with PaperCut.
PaperCut is strongly advising all customers to install Release 2, even if they have already applied the first emergency patch. The updated patch is available for PaperCut NG and MF versions 24, 25, and 26 across Windows, Linux, and macOS. Customers running version 23 or earlier are encouraged to upgrade to the latest version. Site Servers and secondary/print servers also require upgrades to the patched versions, while components like Print Deploy and Mobility Print are unaffected.
In addition to patching, PaperCut recommends restricting access to web interfaces to trusted IP addresses using firewall rules or network access controls. Administrators should also monitor for suspicious post-exploitation activity originating from the `pc-app.exe` process, look for missing or truncated `server.log` files, and be alert for specific errors in the `server.log`, such as "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST".
PaperCut has not disclosed the identity of the attackers or the full extent of post-compromise activities, stating that the attacks appear limited and targeted. The company is withholding further details about post-exploitation while its investigation continues, to avoid complicating affected customers' response efforts. PaperCut has committed to publishing indicators of compromise once they are verified.
This incident follows previous attacks on PaperCut servers in 2023, where CVE-2023-27350, an authentication bypass and remote code execution vulnerability, was exploited. Those earlier attacks were linked to various threat actors, including ransomware operations like Clop and LockBit, Iranian state-backed hacking groups, and the Bl00dy Ransomware Gang.
