PaperCut Zero-Day RCE Chain - Release 2 Patch and Response Guide

PaperCut has released a second emergency security update for PaperCut NG and PaperCut MF after confirming customer incidents involving an actively exploited vulnerability chain capable of pre-authentication remote code execution (RCE).

The vulnerabilities, CVE-2026-81578 and CVE-2026-82078, affect PaperCut NG and MF. CVE-2026-81578 allows an unauthenticated attacker, under specific conditions, to modify certain system configuration parameters. CVE-2026-82078 can turn control of relevant configuration into arbitrary Java bytecode execution under the security context of the PaperCut server process.

PaperCut published Emergency Patch Release 2 on August 28 with additional hardening developed following work with its internal security team and external researchers, including Huntress and watchTowr. The company recommends installing Release 2 even if the original emergency patch has already been deployed.

As of PaperCut's August 29 advisory update, the vendor had confirmed customer incidents and its investigation remained active. No threat actor or campaign attribution has been established in the authoritative sources reviewed.

The key technical development since PaperCut's initial August 27 warning is confirmation of how the two vulnerabilities can be chained from unauthenticated access to code execution.

CVE-2026-81578 is an improper access-control vulnerability categorized as CWE-306, Missing Authentication for Critical Function. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before PaperCut completes its access-validation checks.

PaperCut says the vulnerability enables an unauthenticated attacker to modify certain system configurations. The vendor assigns it a CVSS 4.0 score of 8.8, rated High.

CVE-2026-82078 is rated Critical, with a CVSS 4.0 score of 9.4. PaperCut's database connection utilities instantiate database-driver classes based on configurable driver names without validating those selections against an approved allowlist.

An attacker who can manipulate the relevant configuration can cause arbitrary Java bytecode residing on the application's classpath to execute under the security context of the PaperCut server process.

Independent Rapid7 analysis describes the broader attack path: the access-control weakness permits unauthenticated access to privileged PaperCut functionality, allowing external database lookup settings to be altered and then triggered to achieve code execution. Rapid7 also found that the original emergency patch could be bypassed using a different page in the crafted request. Emergency Patch Release 2 addresses that bypass.

The resulting chain is particularly significant for internet-accessible PaperCut Application Servers because exploitation does not require an existing administrative PaperCut account.

Huntress reproduced pre-authentication RCE against a stock PaperCut NG 25.0.11.75758 installation while investigating the exploitation.

Its proof of concept achieved SYSTEM-level execution on Windows, producing an observable `charmap.exe` process beneath the PaperCut `pc-app.exe` Application Server process.

Huntress reported exploitation in two customer environments as of its initial August 27 publication. Observed post-exploitation activity included system-discovery commands. At that point, Huntress said it had not observed secondary malware, additional command-and-control traffic, or further persistence from the recovered payload.

The Canadian Centre for Cyber Security separately reports that CVE-2026-81578 and CVE-2026-82078 are being exploited in the wild, citing open-source reporting.

The available evidence supports treating vulnerable, internet-facing Application Servers as high-priority potential initial-access points rather than waiting for additional campaign attribution or victim reporting.

PaperCut first published its urgent security bulletin on August 27 after confirming customer incidents involving active exploitation.

The vendor released its first emergency patch for versions 25 and 26 at 02:10 AEST on August 28. Emergency Patch Release 2 followed at 20:42 AEST, providing additional hardening developed with PaperCut's internal security team and external researchers. Release 2 for the v24 branch followed at 22:08 AEST.

Release 2 is available for PaperCut NG and PaperCut MF versions 24, 25 and 26 on Windows, Linux and macOS. PaperCut's advisory applies to all NG and MF versions. Customers running versions earlier than v24 are advised to upgrade to the latest version.

The NHS England cyber alert likewise lists all versions as affected and identifies Emergency Patch Release 2 as available for the v24, v25 and v26 branches.

Site Servers and secondary/print servers should also be updated to a patched version rather than patching only the primary Application Server. PaperCut says Print Deploy and Mobility Print are not affected by this advisory and do not require the emergency update.

Organizations that deployed the original emergency patch still need to install Release 2.

PaperCut explicitly recommends installing Emergency Patch Release 2 on systems where the first emergency patch has already been deployed. Rapid7 reports that the original patch could be bypassed and that systems running only that update are not protected against the complete attack path.

For public-facing deployments, PaperCut recommends restricting the Application Server's web interfaces to trusted IP addresses using firewall rules, network access controls or equivalent mechanisms.

Because exploitation has been confirmed, systems that were publicly reachable before Release 2 was installed warrant retrospective compromise assessment. Relevant evidence should be preserved before upgrades or restarts where practicable.

PaperCut has published several investigation leads while explicitly warning that their absence does not establish that a system was unaffected.

Security teams should investigate suspicious post-exploitation activity involving `pc-app.exe`, including alerts from endpoint-security, intrusion-detection and network-monitoring systems. PaperCut also identifies missing, unexpectedly truncated or deleted `server.log` files as potential indicators.

These indicators should not be treated as a binary compromise test. PaperCut warns that their absence does not confirm that a system has not been affected.

Huntress recommends preserving the full PaperCut `server/logs` directory and file metadata, current and nondefault configuration, endpoint process trees involving `pc-app.exe`, reverse-proxy and WAF records, firewall, DNS and network-flow logs, and recent services, scheduled tasks, autoruns and file-creation activity.

Huntress also identified additional investigation leads from observed attacks, including unexpected `.class` files under `server/lib`, associated `.cmd` or `.out` files, changes to external user-lookup configuration, and PaperCut processes spawning command shells or system-discovery utilities. Filenames observed in individual attacks should not be assumed to remain constant.

Installing Release 2 mitigates the disclosed vulnerabilities, but patching does not remove attacker access or persistence that may already have been established.

Where compromise is suspected, PaperCut recommends securing current server backups, completely wiping and rebuilding the Application Server, restoring a clean backup taken before suspicious behavior was detected, and activating the organization's incident-response procedures.

For long-term hardening of server exposure and monitoring capabilities, see our guide to Managed Cybersecurity for GCC SMBs.

PaperCut's August 29 update adds an operational consideration. At 16:35 AEST, the company said it had received reports that SAML and the external-database Card/ID number lookup feature were not working as expected after patching and that it was investigating.

For installations using an external database for Card/ID lookups, PaperCut provides additional configuration instructions in its security bulletin. The default for the new Card/ID lookup security setting is disabled, so affected customers should follow the vendor's specific post-installation guidance.

The reported operational problems do not change PaperCut's recommendation to install Release 2. Administrators should test affected authentication and Card/ID workflows after deployment and continue monitoring the bulletin while PaperCut investigates.

There is currently no authoritative attribution tying the exploitation to a named threat actor or established campaign. PaperCut has confirmed customer incidents, and Huntress has documented exploitation in two customer environments, but the available evidence does not establish the total number of compromised organizations or broader attacker objectives.

PaperCut also states that its visibility into individual customer environments is limited and that it cannot assess the full impact resulting from a compromised server.

Remediation priority should therefore be based on confirmed active exploitation and a demonstrated pre-authentication RCE chain rather than on campaign attribution or additional victim reporting.

For environments managed by Cyberactics, relevant response activities include identifying exposed PaperCut servers, implementing emergency access restrictions, and correlating PaperCut `server.log` data, `pc-app.exe` process telemetry, endpoint events, firewall records, DNS data and network-flow evidence. Evidence of possible exploitation should shift the response from vulnerability remediation to containment, forensic investigation and clean recovery in accordance with PaperCut's guidance.

PaperCut's security bulletin remains the authoritative source for Release 2 downloads, checksums, current investigation indicators and post-patch guidance. The bulletin was last updated on August 29, 2026, and PaperCut says its investigation is continuing.