What Happened
Two PaperCut NG/MF vulnerabilities patched just days ago — after being exploited as zero-days — are now being used in data theft attacks, according to new honeypot findings from threat-intelligence firm Defused. The flaws, tracked as CVE-2026-81578 and CVE-2026-82078, chain an authentication bypass with an unsafe-reflection bug to give attackers a path from an unauthenticated web request to full remote code execution on PaperCut's print-management servers, which are used by an estimated 100 million users across 70,000+ organizations.
This is a direct follow-up to PaperCut's emergency patch saga, which began August 27 when the vendor disclosed active exploitation reported by a university customer. See our earlier coverage: PaperCut Releases Second Emergency Patch for Exploited Flaws.
Attackers Skip RCE, Go Straight for Data
Defused says it began observing exploitation in its honeypots on August 29 (UTC), but the behavior looks different from the RCE chain documented in public write-ups. In the firm's words: "An actor is abusing the auth bypass to hijack PaperCut's external user-lookup... Unlike the RCE path in public writeups, the actor goes for data theft — dumping DB tables via Derby."
Rather than deploying malware or establishing persistence, attackers are using the authentication bypass to reach PaperCut's external user-lookup functionality and pull data directly out of the embedded Apache Derby database — a quieter, faster objective than the code-execution chain the vulnerabilities were first reported for.
Scale of Exposure
Shadowserver is tracking more than 800 PaperCut MF/NG servers exposed directly to the internet, though it's unclear how many of those are honeypots, already patched, or genuinely vulnerable production systems. watchTowr, which helped validate PaperCut's fixes, has warned that any internet-facing instance that was exposed in the days following disclosure should be treated as likely already compromised, regardless of whether an incident has been confirmed.
Patch Status: Now on Release 3
PaperCut is urging all customers with internet-facing application servers to install Emergency Patch Release 3 immediately — the third patch iteration in under a week, after researchers found bypasses in both the original fix and Release 2. Reinstallation is required even for organizations that already applied an earlier emergency patch.
CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on August 31, giving federal civilian agencies until September 14 to remediate under Binding Operational Directive 26-04. Full technical details on the vulnerability chain are in our advisory: CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability.
Historical Pattern
PaperCut has been down this road before. The 2023 authentication-bypass flaw CVE-2023-27350 was exploited by LockBit and Clop affiliates, along with the Bl00dy ransomware gang targeting the education sector, and Muddywater and APT35 activity was also linked to abuse of PaperCut flaws that year. A pre-authentication vulnerability chain in software this widely deployed tends to attract exactly the kind of attention it's getting now.
Recommendations
- Install Emergency Patch Release 3 on all PaperCut NG/MF instances — do not assume Release 1 or 2 is sufficient.
- Treat any internet-facing PaperCut server as potentially compromised if it was exposed between August 27 and patch installation, not just unpatched ones.
- Audit for data-exfiltration indicators, specifically calls to the external user-lookup function and unusual Derby database query patterns — traditional RCE/malware indicators of compromise won't catch this activity.
- Restrict the PaperCut Application Server to internal/trusted network access where internet exposure isn't a business requirement.
Why This Matters
The shift from reconnaissance to data theft in under 48 hours shows how quickly opportunistic attackers pivot once a working exploit chain is public. For defenders, "we patched it" is no longer the full story — the priority now is determining whether data was already taken during the exposure window, not just closing the hole going forward.
Sources
- BleepingComputer — Recently patched PaperCut zero-days used in data theft attacks
- The Hacker News — PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
- SecurityWeek — PaperCut Exploitation Escalates to Active Intrusions
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog