Not even 19 hours after the release of the emergency patch for PaperCut NG and MF, as the company had to prepare a replacement. Researchers have found several ways to circumvent the initial protection, and also found another option for bypassing authentication. PaperCut has released Emergency Patch Release 2 and recommends installing a new version even to administrators who have already managed to put the first patch.
The story began on August 27, when PaperCut warned of real attacks on client servers. At first, the company did not disclose technical details or even call CVE to give administrators time to close access to vulnerable systems. The first emergency update for the 25 and 26 branches appeared on August 28 at 02:10 Australian time. Already at 20:42 of the same day, PaperCut published Release 2 with additional protection developed along with Huntress and watchTowr. The second correction was later issued for branch 24.
Behind the initially unknown zero-day was a chain of two vulnerabilities. CVE-2026-81578 received an 8.8 score of 10 and allows the remote user without an account to access the administrative functions of PaperCut and change part of the settings. The problem is how the web interface checked access rights. A specially formed query could show one page, available without authorization, but simultaneously run the component of another, secure administrative page. The verification of the rights was oriented to the displayed page and missed the action that was performed in the background.
After the configuration change, CVE-2026-82078 with a score of 9.4 enters the case. PaperCut allowed database driver classes to be specified through the settings and did not check the selected class with the allowed list. Having been able to change the configuration through the first vulnerability, the attacker could force the server to download arbitrary Java code from the classpath application. As a result, two errors turn into a full remote execution of the code without prior authentication.
Huntress managed to fully reproduce the chain on the standard PaperCut NG 25.0.11.75758 installation. During the demonstration, the researchers remotely launched the Windows application charmap.exe on behalf of SYSTEM through the PaperCut pc-app.exe process. This level of privilege gives the attacker almost complete control over the server.
It’s not just about the laboratory of Concept. Huntress discovered the operation of at least two client infrastructures. In one case, the August 26 attack took less than two minutes. The attackers launched teams whoami & ver, to determine the username and version of Windows. In the second incident on August 27, the teams were added tasklist, allowing you to get a list of working processes.
The researchers also found Java files uploaded to the server Udydn.class and Moo97.class. The code allowed you to execute commands in both Windows and Linux, read and write files and collect information about the system. After work, the malicious class tried to delete the created files and the log server.log, making it difficult to investigate. Huntress has not yet seen the installation of additional malware, fixing in the system or further activity through command servers. The observed actions are more similar to the exploration or verification of the exploit.
The situation became even more dangerous after analyzing the first emergency update. watchTowr reported that researchers managed to fully reproduce vulnerabilities, find several ways to bypass the initial patch and discover an additional mechanism for bypassing authentication. Huntress also informed PaperCut about several rounds of the first version of the fix. It was after such verification that Release 2 appeared with additional strengthening of protection. There is no evidence that the real attackers have already used the first patch.
PaperCut considers all versions of NG and MF potentially affected. Emergency Patch Release 2 is released for Windows, Linux and MacOS. Users of version 23 and older issues the company recommends to switch to the current branch. You need to update not only the main Application Server, but also Site Servers and secondary print servers. Print Deploy and Mobility Print are not covered by two vulnerabilities.
One patch PaperCut does not yet consider sufficient measure. The Company advises to remove the Application Server web interface from the open Internet and allow access only from trusted addresses or through a controlled administrative channel. According to Shadowserver, at the time of the disclosure of the problem on the Internet remained available about a thousand servers PaperCut, most of them were in North America and Europe.
Administrators are advised to check the launch of suspicious processes from pc-app.exe, unexpectedly removed or circumcised server.log, unknown .class-files in the directory server/lib and errors No suitable driver found for jdbc:no:x or Database error looking up cardID: VALUES CAST. If you suspect a hack, PaperCut advises not to be limited to an update, but to completely rebuild Application Server and restore data from a clean backup created before the signs of an attack appear.
PaperCut already had a similar story. In 2023, the CVE-2023-27350 vulnerability allowed authentication and code to be bypassed on the server. The hole quickly began to use different criminal groups. CISA and the FBI linked the attacks through PaperCut to the Bl00dy ransomware, and later the operation of CVE-2023-27350 was recorded by LockBit and other groups. In some attacks, the hacking of PaperCut became the initial point of penetration into the internal network.
The new chain repeats the most nasty part of the 2023 scenario. The Print Management Server is often located inside the corporate network and works with high privileges, and no password or prior access is needed to attack a vulnerable system. Now another risk factor has been added to the active operation. The first attempt to close the hole could not withstand the verification of the researchers, so administrators who installed the initial emergency patch will have to be updated again.
The story began on August 27, when PaperCut warned of real attacks on client servers. At first, the company did not disclose technical details or even call CVE to give administrators time to close access to vulnerable systems. The first emergency update for the 25 and 26 branches appeared on August 28 at 02:10 Australian time. Already at 20:42 of the same day, PaperCut published Release 2 with additional protection developed along with Huntress and watchTowr. The second correction was later issued for branch 24.
Behind the initially unknown zero-day was a chain of two vulnerabilities. CVE-2026-81578 received an 8.8 score of 10 and allows the remote user without an account to access the administrative functions of PaperCut and change part of the settings. The problem is how the web interface checked access rights. A specially formed query could show one page, available without authorization, but simultaneously run the component of another, secure administrative page. The verification of the rights was oriented to the displayed page and missed the action that was performed in the background.
After the configuration change, CVE-2026-82078 with a score of 9.4 enters the case. PaperCut allowed database driver classes to be specified through the settings and did not check the selected class with the allowed list. Having been able to change the configuration through the first vulnerability, the attacker could force the server to download arbitrary Java code from the classpath application. As a result, two errors turn into a full remote execution of the code without prior authentication.
Huntress managed to fully reproduce the chain on the standard PaperCut NG 25.0.11.75758 installation. During the demonstration, the researchers remotely launched the Windows application charmap.exe on behalf of SYSTEM through the PaperCut pc-app.exe process. This level of privilege gives the attacker almost complete control over the server.
It’s not just about the laboratory of Concept. Huntress discovered the operation of at least two client infrastructures. In one case, the August 26 attack took less than two minutes. The attackers launched teams whoami & ver, to determine the username and version of Windows. In the second incident on August 27, the teams were added tasklist, allowing you to get a list of working processes.
The researchers also found Java files uploaded to the server Udydn.class and Moo97.class. The code allowed you to execute commands in both Windows and Linux, read and write files and collect information about the system. After work, the malicious class tried to delete the created files and the log server.log, making it difficult to investigate. Huntress has not yet seen the installation of additional malware, fixing in the system or further activity through command servers. The observed actions are more similar to the exploration or verification of the exploit.
The situation became even more dangerous after analyzing the first emergency update. watchTowr reported that researchers managed to fully reproduce vulnerabilities, find several ways to bypass the initial patch and discover an additional mechanism for bypassing authentication. Huntress also informed PaperCut about several rounds of the first version of the fix. It was after such verification that Release 2 appeared with additional strengthening of protection. There is no evidence that the real attackers have already used the first patch.
PaperCut considers all versions of NG and MF potentially affected. Emergency Patch Release 2 is released for Windows, Linux and MacOS. Users of version 23 and older issues the company recommends to switch to the current branch. You need to update not only the main Application Server, but also Site Servers and secondary print servers. Print Deploy and Mobility Print are not covered by two vulnerabilities.
One patch PaperCut does not yet consider sufficient measure. The Company advises to remove the Application Server web interface from the open Internet and allow access only from trusted addresses or through a controlled administrative channel. According to Shadowserver, at the time of the disclosure of the problem on the Internet remained available about a thousand servers PaperCut, most of them were in North America and Europe.
Administrators are advised to check the launch of suspicious processes from pc-app.exe, unexpectedly removed or circumcised server.log, unknown .class-files in the directory server/lib and errors No suitable driver found for jdbc:no:x or Database error looking up cardID: VALUES CAST. If you suspect a hack, PaperCut advises not to be limited to an update, but to completely rebuild Application Server and restore data from a clean backup created before the signs of an attack appear.
PaperCut already had a similar story. In 2023, the CVE-2023-27350 vulnerability allowed authentication and code to be bypassed on the server. The hole quickly began to use different criminal groups. CISA and the FBI linked the attacks through PaperCut to the Bl00dy ransomware, and later the operation of CVE-2023-27350 was recorded by LockBit and other groups. In some attacks, the hacking of PaperCut became the initial point of penetration into the internal network.
The new chain repeats the most nasty part of the 2023 scenario. The Print Management Server is often located inside the corporate network and works with high privileges, and no password or prior access is needed to attack a vulnerable system. Now another risk factor has been added to the active operation. The first attempt to close the hole could not withstand the verification of the researchers, so administrators who installed the initial emergency patch will have to be updated again.
