Print management software does not top anyone's security priority list. It should when it serves 100 million users across more than 70,000 organizations and someone just found a working, unauthenticated path to remote code execution on it.
PaperCut zero-day chain CVE-2026-81578 and CVE-2026-82078 enables pre-auth RCE on print servers, and CISA added both to its KEV catalog with a September 14, 2026, patch deadline.
Two vulnerabilities in PaperCut NG and PaperCut MF, tracked as CVE-2026-81578 and CVE-2026-82078, can be chained to bypass authentication and execute arbitrary Java bytecode on the application server. PaperCut began releasing emergency patches on August 28, 2026, and by September 1 had issued a third patch version because the first two were insufficient. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, giving federal civilian agencies until September 14 to remediate. Active exploitation is confirmed by multiple threat intelligence teams, and at least one actor is using the chain to dump database tables for data theft rather than deploy ransomware.
If you run PaperCut and your application server faces the public internet, the clock is already running.
What exactly is the PaperCut exploit chain?
The attack works in two stages, both reachable without credentials.
The first vulnerability, CVE-2026-81578, is an authentication bypass in the web management interface. It carries a CVSS v4 score of 8.8 (High) and is classified as CWE-306, missing authentication for a critical function. An unauthenticated attacker can invoke privileged PaperCut components directly, including system configuration panels that are supposed to require admin login.
The second vulnerability, CVE-2026-82078, is an unsafe dynamic class-loading flaw in the database connector utilities. It carries a CVSS v4 score of 9.4 (Critical) and is classified as CWE-470, use of externally controlled input to select classes or code. After bypassing authentication, an attacker can reconfigure PaperCut's external database lookup feature, which is normally used to connect to an external card database for print billing. By pointing that lookup at a malicious payload, the attacker tricks the server into loading arbitrary Java bytecode and executing it.
Huntress reproduced the full pre-authentication RCE chain against a vanilla PaperCut NG server running version 25.0.11, confirming that default installations are vulnerable. The technical breakdown from Huntress describes the chain as straightforward: bypass auth, modify the database connector configuration, trigger the lookup, and the server loads your code.
The critical-severity class-loading flaw is the payload delivery mechanism. The high-severity auth bypass is what makes the whole chain work without credentials. Neither vulnerability requires privileged access to trigger.
How widespread is the exploitation right now?
Exploitation started before the patches were public. Huntress confirmed attacks against at least two customers with the first attempts observed on August 26, one day before PaperCut published its advisory on August 27. The observed post-exploitation activity was limited: base64-encoded commands that decoded to whoami & ver, aimed at identifying the victim's user account and operating system. Huntress noted no secondary malware, command-and-control traffic, or additional persistence in those cases.
By August 29, threat intelligence company Defused confirmed a different attack pattern in its honeypots. The actor was abusing the auth bypass to hijack PaperCut's external user-lookup, but instead of going for RCE, the attacker was dumping database tables via Derby. That is data theft, not ransomware deployment, and it means the attacker may be quietly exfiltrating information without leaving the noisy artifacts that trigger detection tools. PaperCut has published indicators of compromise to help defenders identify this pattern.
The exposure surface is manageable but not trivial. Shadowserver tracks over 800 PaperCut MF and NG servers exposed online, though SecurityWeek's reporting puts the figure closer to 1,000. A majority are in North America and Europe. There is no public data on how many of those have already been patched or are honeypots, but a Metasploit module is now available, which means automated scanning will accelerate.
CISA does not add a CVE to the KEV catalog based on theoretical risk. The listing requires confirmed evidence of exploitation in the wild, and it comes with enforcement teeth for federal agencies. Under CISA's binding operational directive, federal civilian executive branch agencies have until September 14, 2026 to apply patches or document mitigations, as detailed in the CISA KEV listing analysis.
The chart below shows how quickly the response unfolded and how far the federal patching window stretches compared to attacker speed.
The gap between day 0 (first observed exploitation on August 26) and day 19 (the federal patch deadline on September 14) is the window attackers have to find and compromise exposed servers. That is nearly three weeks. A Metasploit module went public within days of disclosure.
Why does PaperCut keep showing up in ransomware paths?
This is not the first time PaperCut has been a stepping stone for serious attacks. The platform's history with exploitation goes back years, and the pattern is consistent: exposed print servers become initial access points, and ransomware operators walk through them.
In April 2023, a critical RCE flaw (CVE-2023-27350) and a high-severity information disclosure bug (CVE-2023-27351) were chained in attacks linked to the LockBit and Clop ransomware gangs. Microsoft later confirmed that Iranian state-backed groups Muddywater and APT35 had also joined those attacks. The threat groups abused PaperCut's Print Archiving feature, which saves copies of all documents sent through the print server, giving attackers access to sensitive printed material. One month later, in May 2023, the FBI and CISA warned that the Bl00dy Ransomware gang was exploiting the same flaw for initial access to target networks.
CISA flagged another PaperCut RCE vulnerability, CVE-2023-2533, as actively exploited in July 2025.
The pattern tells you something about how attackers view print infrastructure. PaperCut servers are often maintained by IT teams who do not treat them as critical security assets. They sit in university IT departments, state agency back offices, and corporate print rooms. They are connected to Active Directory. They archive documents containing salary data, student records, and contract terms. And they frequently end up internet-facing because someone needed remote access for a printer config change and never closed the firewall rule.
This is the same dynamic that has played out with edge appliances across the board. As we noted in our coverage of CISA KEV edge gear vulnerabilities, appliances that IT teams forget about become the soft targets that ransomware operators specialize in finding.
What should you do if you run PaperCut in production?
The guidance is straightforward, but the third-patch wrinkle makes execution urgent.
- Patch to the third emergency patch, not the first or second. PaperCut released emergency patches for versions 24, 25, and 26. If you applied the first or second emergency patch, you are not fully protected. PaperCut's September 1 update explicitly states that organizations running either of the earlier patch versions must apply the third immediately. These builds have not gone through the vendor's normal release process, which means you should plan for a follow-up patch once the formal release is available.
- Remove the application server from the public internet. PaperCut recommends restricting web access to trusted IP addresses only, using firewall rules, network access controls, reverse-proxy restrictions, or equivalent measures. If your PaperCut server is behind a VPN or internal-only, the remote attack surface drops to near zero. This is the single most effective mitigation if you cannot patch immediately.
- Check for indicators of compromise. PaperCut has published IOCs to help defenders identify ongoing or past attacks. Given that exploitation began on August 26 and the data-theft variant observed by Defused may leave fewer obvious traces, review database access logs and look for unexpected queries against Derby tables. Huntress observed
whoamiandvercommands executed via base64-encoded payloads, so check command execution logs for similar patterns. - Audit what your PaperCut server can see. Print management servers are often domain-joined and may have broad file system access for print archiving. If an attacker got RCE, they had the same permissions as the PaperCut service account. Check what that account can reach, and treat any compromised server as a potential lateral movement vector, not just a standalone print box.
- Watch for the Metasploit module. Public exploit code means the attacker pool expands from sophisticated threat groups to anyone who can run a scanner. The window between skilled attacker and opportunistic scanner is now measured in days, not weeks.
The forgotten server is the real risk
The PaperCut pattern is a recurring lesson in attack surface management. Print infrastructure does not get the same patching cadence as your database servers or your identity provider. It gets deployed, configured, and forgotten. Then someone finds an auth bypass on it, and because it is domain-joined and internet-facing, it becomes a bridge from the public internet straight into your internal network.
The third emergency patch fixes the code. The longer-term fix is to stop treating print management as infrastructure that can safely sit on the open internet. If your PaperCut server is still public-facing today, the only question is whether you fix it before the scanner finds it, or after.
