PaperCut NG/MF Zero-Day Vulnerabilities Chained in Active Attacks

Threat summary

On August 27, 2026, PaperCut Software disclosed active exploitation of a vulnerability chain affecting PaperCut NG and PaperCut MF and published an emergency security advisory for customers.

PaperCut NG and MF are print management platforms used to manage printing, copying, scanning, user authentication, and print accounting across enterprise environments. Both products rely on a central PaperCut Application Server that hosts the web interface, manages administration and configuration, authenticates users, communicates with print servers and multifunction devices, and stores print management data. In many environments, a single Application Server serves as the central management component for the entire PaperCut deployment.

The vulnerabilities involved in the attack chain are tracked as CVE-2026-81578 and CVE-2026-82078.

• CVE-2026-81578 (CVSS 8.8) is an authentication bypass vulnerability. Under specific conditions, a threat actor can perform certain administrative actions before the application completes its security checks. This can allow changes to system configuration settings without valid credentials.
• CVE-2026-82078 (CVSS 9.4) affects how PaperCut loads certain software components used for database connectivity. If a threat actor can modify the relevant configuration settings, the application may load and execute Java code already available on the server.

Individually, CVE-2026-81578 provides unauthorized access to certain administrative functionality, while CVE-2026-82078 provides a mechanism for executing Java code. PaperCut states that chaining the two vulnerabilities allows a threat actor to modify configuration settings and then execute code through the PaperCut service without authentication.

Researchers initially observed system discovery activity, including enumeration of user accounts, operating system information, and running processes. New guidance published on 31 August 2026 indicates that some threat actors were observed enumerating domain controllers and logged-on users, downloading payloads from external file-sharing services, and installing SimpleHelp and AnyDesk remote access software to maintain access to compromised servers.

At the time of reporting, public internet scans identified approximately 1,000 internet-accessible PaperCut instances.

As of August 31, PaperCut's investigation remains ongoing. The company has published indicators of compromise, emergency remediation guidance, and Emergency Patch Release 2, which was released on August 28 and includes additional hardening measures beyond the initial emergency update.

Emergency Patch Release 2 is available for supported v24, v25, and v26 deployments while PaperCut continues development of a permanent software release.

Analysis

PaperCut NG and MF have been targeted by threat actors in the past.

In 2023, attackers exploited CVE-2023-27350 and CVE-2023-27351, vulnerabilities affecting the same PaperCut Application Server component involved in the current incident. The activity was later linked to ransomware operations associated with Clop and LockBit affiliates. Several PaperCut flaws have since been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog.

In most environments, the PaperCut Application Server is intended for internal use and primarily communicates with user workstations, print servers, multifunction printers, Microsoft Active Directory, and internal databases. Internet exposure is typically the result of remote administration requirements, access to PaperCut web portals from outside the corporate network, remote printing services, third-party support arrangements, or legacy deployment decisions.

PaperCut's guidance has focused on restricting access to trusted IP addresses and removing direct internet accessibility where possible. This reflects the fact that public internet access is not required for normal operation and represents a significant risk factor in the current attacks.

The confirmed impact is code execution in the context of the PaperCut service process. Any additional impact depends on the permissions assigned to the PaperCut service account, the server's access to other systems, available credentials, network segmentation, and existing security controls.

A worst-case scenario involves an internet-facing PaperCut Application Server with elevated privileges and broad connectivity to internal resources, providing a foothold for additional activity inside the environment.

Mitigations

Organizations are advised to identify all PaperCut Application Servers and determine whether they are accessible from the internet. Internet-accessible systems should be prioritized for deployment of Emergency Patch Release 2 or later vendor releases, including systems that previously received the initial emergency patch.

Organizations running versions older than v24 should upgrade to a supported version because emergency patches are not available for older releases. Site Servers and secondary print servers are also advised to be updated where applicable.

PaperCut has published indicators of compromise and continues to update its guidance as the investigation progresses.

Organizations are advised to review alerts from intrusion detection, endpoint security, and network monitoring tools involving the PaperCut Application Server, particularly suspicious activity associated with the pc-app.exe process.

Administrators are also advised to investigate missing, truncated, or deleted server.log files and review logs for suspicious entries identified by the vendor:

• ERROR No suitable driver found for jdbc:no:x

• ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.

Other indicators include:

• A Windows service named Remote Access Service running SimpleService.exe.
• Files located under C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\.
• Unexpected installations of SimpleHelp or AnyDesk.

Where compromise is suspected, the vendor advises preserving forensic evidence, securing backups, and rebuilding affected Application Servers from a known-good backup.

Organizations are advised to restrict access to the PaperCut Application Server even when indicators of compromise are not identified. PaperCut recommends using firewall rules, network access controls, or equivalent measures to ensure the server's web interfaces are accessible only from trusted networks and administrative sources.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up