Malicious attackers are actively exploiting newly disclosed vulnerabilities in PaperCut NG and PaperCut MF that can allow unauthorized remote code execution on vulnerable servers. In response, PaperCut has issued another emergency update for versions 24, 25 and 26, incorporating additional security hardening.
"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said.
The attack involves sending specially crafted, unauthenticated requests that manipulate server configuration settings. According to Huntress, the flaw stems from an authorization weakness that can cause PaperCut's security checks to validate the page being displayed rather than the underlying component responsible for carrying out an action.
In vulnerable versions, attackers can exploit this behavior to alter server configurations and gain access to sensitive administrative endpoints. Those endpoints can then be abused to perform unsafe operations and ultimately execute attacker-controlled code.
PaperCut has identified two vulnerabilities linked to the attacks:
-
CVE-2026-82078 (CVSS 9.4): An unsafe dynamic class-loading flaw in the database connection utilities of PaperCut MF and NG. The software loads database driver classes according to configurable driver names without checking them against an approved allowlist.
-
CVE-2026-81578 (CVSS 8.8): An improper access-control vulnerability in the web management interface. Under certain circumstances, unauthenticated remote requests can reach administrative backend functions before access checks have been fully completed.
The latest update follows PaperCut's release of a second emergency patch for versions 24, 25 and 26, which the company described as containing "additional hardening beyond the original emergency patch." PaperCut has not yet disclosed detailed information about the threat actors or their broader objectives.
However, the company has provided several indicators of compromise (IoCs) that organizations can use to investigate potentially affected systems.
Potential indicators in server.log include:
-
DB URL: jdbc:derby:memory:pwn;create=true
-
Database error looking up cardID: VALUES CAST(X'cafebabe
-
Database error looking up cardID: VALUES CAST('
-
DB URL: jdbc:no:x DB Driver: <5-char random name>
Security teams should also check for files such as:
-
<install>\server\lib\<5-char-name>.class
-
<install>\server\data\content\<5-char-name>.cmd
<install>\server\data\content\<5-char-name>.out
PaperCut warned that attackers may delete these files during the course of an intrusion, meaning that their absence cannot be treated as evidence that a system was not compromised.
Other activity observed by researchers includes the PaperCut application process spawning shell processes such as cmd.exe and executing commands including "whoami & ver". Investigators have also identified the deployment of remote-access software, including SimpleHelp and AnyDesk, potentially to maintain access to compromised systems.
"At this time, we don't have enough evidence to determine the threat actors' ultimate end goal," John Hammond, senior principal security researcher at Huntress, told The Hacker News. "Based on what we observed, the activity appears consistent with early-stage reconnaissance or validation, including commands to identify the victim’s user account and operating system."
Researchers at preemptive exposure management company watchTowr said the two vulnerabilities can be combined to bypass authentication and achieve remote code execution.
"CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," Jake Knott, head of threat intelligence at watchTowr, told The Hacker News.
watchTowr also reported finding several techniques capable of bypassing the initial security fixes, along with another authentication bypass issue. One of the identified bypasses has been addressed in PaperCut's second emergency update, although researchers say additional bypasses affecting the newest patched version have also been discovered.
Huntress similarly reported a bypass affecting the first emergency patch. After reviewing the latest update, the company said "analyzing this second set of emergency patches, we do see security improvements that remediate parts of the attack chain as we understand it."
Huntress has observed limited exploitation across two customer environments. In those incidents, attackers used Base64-encoded commands on compromised servers to gather basic system information, including the logged-in user and operating system, using "whoami & ver".
Attackers were also seen deploying a Java .class file capable of running across both Windows and Linux environments. The file can execute commands, identify characteristics of the compromised machine and generate directory listings. The resulting information was saved as Udydn.out under the /data/content/ directory relative to the PaperCut installation.
After collecting the information, the malicious Java file removed Udydn.out, the server's server.log, and /data/internal/derby.log, potentially reducing evidence available for forensic investigation.
In a separate incident observed on August 27, 2026, attackers reportedly deployed another version of the Java file that expanded its reconnaissance capabilities by adding the running-process list through the command "whoami & ver & tasklist".
Organizations running PaperCut NG or MF should immediately eliminate unnecessary public internet exposure and install the latest security updates. Administrators should also consider limiting access to the PaperCut Application Server web interface to trusted IP addresses or placing it behind a VPN or another controlled administrative access mechanism.
"PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated," Knott said in a statement shared with The Hacker News.
"Organizations with vulnerable internet-facing instances of PaperCut need to remove public internet access where possible, and begin hunting for signs of compromise, such as looking for 'Database error looking up cardID: VALUES CAST' errors in log files."
