PaperCut Releases Second Emergency Patch for Exploited Flaws

What Happened

PaperCut has shipped a second emergency security update — Emergency Patch (Release 2) — for its widely deployed PaperCut NG and PaperCut MF print management software, after security researchers found multiple ways to bypass the vendor's original emergency fix released just a day earlier.

The saga started on August 27, 2026, when PaperCut published an urgent advisory saying it was investigating active exploitation reported by a university customer's security and incident-response teams. PaperCut reproduced the issue and rushed out an initial round of emergency patches for the NG/MF 25 and 26 branches within hours, followed shortly by a build for the older v24 branch. By the next day, working with external researchers at Huntress and watchTowr, PaperCut confirmed the first patch could still be bypassed and released Release 2 with "additional hardening beyond the original emergency patch" — urging every customer to install it even if the original patch was already applied.

The Vulnerabilities

CVE-2026-81578 lets an unauthenticated remote request reach administrative backend functions in the web management interface before access-validation checks finish running. Researchers at watchTowr explained how the two flaws chain together: "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution." That second flaw stems from PaperCut loading database driver classes by name without checking them against an approved allowlist — letting an attacker point the database connector at an attacker-controlled class and achieve arbitrary code execution on the server.

Why a Second Patch Was Needed

The original Release 1 patch closed the most direct exploitation path, but watchTowr and Huntress subsequently identified additional bypasses in the fully patched build, along with further authentication weaknesses in the same interface. PaperCut's Release 2 patches at least one of those newly discovered bypasses and layers on extra hardening around the ConfigEditor and driver-loading logic that the original fix didn't fully address. Any organization that applied only the first emergency patch should treat itself as still exposed until Release 2 is installed.

Active Exploitation

Huntress reports limited, targeted exploitation in two customer environments to date. Observed post-exploitation activity included base64-encoded reconnaissance commands (whoami and ver) run on the compromised server, along with OS-agnostic, hex-encoded Java .class files used as a bridge to execute commands on the underlying operating system. Huntress noted the activity looked like fingerprinting and process enumeration rather than malware deployment — no persistence mechanisms or follow-on payloads have been confirmed, and artifacts were reportedly deleted after execution. PaperCut itself described the campaign as "appears limited and targeted," and the identity of the attackers has not been disclosed.

PaperCut has a history here: the 2023 authentication-bypass flaw CVE-2023-27351 was exploited by ransomware affiliates, including the Bl00dy gang in attacks against the education sector, and re-entered CISA's Known Exploited Vulnerabilities catalog earlier this year.

Remediation

• Apply Emergency Patch (Release 2) immediately for the 24, 25, and 26 branches — reinstalling is required even if Release 1 is already applied.
• Upgrade off version 23 or earlier rather than waiting for a patch build; PaperCut is directing legacy customers to move to a supported branch.
• Restrict network access to the PaperCut Application Server to trusted/internal IP addresses only via firewall rules or a reverse proxy, especially for any internet-facing instance.
• Review server logs for indicators of compromise, including missing or truncated server.log files and entries such as ERROR No suitable driver found for jdbc:no:x or ERROR DatabaseUtils - Database error looking up cardID.
• Watch for suspicious activity around pc-app.exe and unexpected process execution originating from the PaperCut service account.

Why This Matters

PaperCut NG/MF sits on print servers across schools, universities, and enterprises worldwide — precisely the kind of quietly critical infrastructure that rarely gets prioritized for patching until it's already under attack, as the 2023 Bl00dy ransomware campaign demonstrated. A pre-authentication chain that goes from a web-interface access-control gap straight to remote code execution is about as severe as it gets, and the fact that the vendor's first emergency fix didn't hold up means defenders can't treat "we already patched" as closed until Release 2 is confirmed installed. Any internet-facing PaperCut deployment should be considered high priority for immediate remediation.

Sources

• BleepingComputer — PaperCut releases second emergency patch for exploited flaws
• The Hacker News — Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
• Rapid7 — PaperCut NG/MF Critical Zero-Day Exploited in the Wild
• Help Net Security — PaperCut NG/MF vulnerability exploited in zero-day attacks