PaperCut NG/MF zero-day chain: CISA adds actively exploited flaws to KEV
PaperCut NG/MF zero-day chain: CISA adds actively exploited flaws to KEV
Executive Summary
CISA has added two actively exploited PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities catalog after PaperCut disclosed emergency fixes for a zero-day chain affecting its Application Server. The two issues, CVE-2026-81578 and CVE-2026-82078, matter because they can be chained into pre-authentication remote code execution against vulnerable PaperCut deployments.
For defenders, this is not a wait-and-see advisory. Print management servers often sit close to identity, file, workstation, and administrative infrastructure. An internet-exposed or broadly reachable PaperCut Application Server should be treated as a high-priority vulnerability exposure, especially where patch status, management interface access, and recent logs are unclear.
What happened?
On August 27, 2026, PaperCut published an urgent security advisory for PaperCut NG and PaperCut MF. The vendor later assigned two CVEs to the issue set:
- CVE-2026-81578: an authentication or access-control weakness in the PaperCut NG/MF web management interface
- CVE-2026-82078: an unsafe dynamic class-loading/reflection issue in database connection utilities
On August 31, 2026, CISA added both vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. That KEV listing shifts the risk conversation from theoretical severity to operational urgency: exploitation has been observed, and exposed systems need rapid remediation.
The most important detail is the chain. CVE-2026-81578 can give an unauthenticated attacker a path to alter sensitive configuration under specific conditions. CVE-2026-82078 can then turn unsafe class loading into arbitrary Java execution in the PaperCut server process. Together, the pair can become a pre-authentication remote code execution path.
Why PaperCut servers are sensitive targets
PaperCut is commonly deployed in schools, universities, public-sector environments, healthcare, legal services, managed offices, and large enterprises. That makes it attractive for opportunistic exploitation and targeted intrusion alike.
Print infrastructure is also frequently underestimated. A compromised PaperCut server may give attackers more than control over print jobs. Depending on deployment architecture, integrations, and permissions, it may expose credentials, directory integrations, stored configuration, administrative workflows, internal hostnames, and routes into segmented networks.
This is why defenders should think beyond the CVSS score. The business risk comes from the server’s position in the environment and from what an attacker can reach after code execution.
Who is affected?
Organizations using PaperCut NG or PaperCut MF should confirm whether their Application Server versions are affected and whether emergency updates have been applied.
Priority should go first to:
- internet-facing PaperCut Application Servers
- systems where the management interface is reachable from broad internal networks
- servers integrated with Active Directory, LDAP, SSO, email, file shares, or payment systems
- environments with incomplete logging around administrative configuration changes
- organizations that cannot quickly prove the PaperCut server has already been updated
Even if the server is not internet-facing, internal reachability still matters. Many real intrusions begin with a lower-value foothold and then pivot toward management systems. A vulnerable PaperCut server inside the network can become a useful lateral movement target after initial compromise.
What defenders should do now
The immediate action is to apply PaperCut’s emergency updates for the affected NG/MF branches. Where patching cannot be completed immediately, restrict access to the Application Server and management interface to trusted administrative IP ranges only, and remove any unnecessary external exposure.
Defenders should also review recent activity for signs that the server was touched before the patch window. Focus on:
- unexpected administrator logins or configuration changes
- new or modified database connection settings
- unusual Java process behavior spawned from the PaperCut server context
- outbound network connections from the PaperCut server to unknown destinations
- web requests hitting management functions from unfamiliar IP addresses
- recently created files, scripts, scheduled tasks, or services on the host
Where suspicious activity exists, treat the server as potentially compromised and begin incident response, including credential rotation for identities and integrations reachable from the PaperCut environment.
Detection and hunting ideas
Security teams should combine web, endpoint, identity, and network telemetry. No single signal is enough, especially if exploitation was brief.
Web and application logs
Review access logs for requests to administrative or configuration-related endpoints from unusual IPs, anonymous sessions, unexpected geographies, or service accounts that do not normally administer PaperCut.
Endpoint telemetry
Look for Java child processes, shell execution, file writes, or suspicious network utilities launched under the PaperCut service context. Code execution through a Java application server often becomes visible as unusual process ancestry rather than a clean vulnerability signature.
Network telemetry
Hunt for outbound traffic from PaperCut servers to infrastructure that has no business relationship with print services. Pay special attention to direct IP connections, newly registered domains, unusual TLS destinations, and traffic shortly after suspicious management requests.
Identity telemetry
Review service accounts, directory integrations, and administrator accounts associated with PaperCut. Watch for anomalous login behavior, new tokens, password resets, privilege changes, or access from hosts that do not normally interact with print management infrastructure.
MITRE ATT&CK framing
| Phase | Defender question | ATT&CK theme |
|---|---|---|
| Initial Access | Was the PaperCut Application Server reachable by the attacker? | Exploit Public-Facing Application |
| Execution | Did the Java service launch commands, scripts, or unexpected child processes? | Command and Scripting Interpreter |
| Persistence | Were services, scheduled tasks, web-accessible files, or accounts added? | Create or Modify System Process |
| Credential Access | Were directory, SSO, mail, database, or integration credentials exposed? | Credentials from Configuration Stores |
| Discovery | Did the server enumerate users, hosts, shares, or directory objects? | System and Network Discovery |
| Lateral Movement | Was the PaperCut host used to reach internal systems? | Remote Services |
| Command and Control | Did the host connect to unusual external endpoints after exploitation? | Application Layer Protocol |
Practical containment checklist
- Patch PaperCut NG/MF using the vendor’s emergency guidance.
- Confirm the Application Server is not exposed to the internet unless absolutely required.
- Restrict management access to trusted administrative networks.
- Preserve PaperCut, web server, endpoint, and network logs before cleanup.
- Hunt for suspicious configuration changes and Java process behavior.
- Rotate credentials tied to PaperCut integrations if compromise is suspected.
- Review firewall and segmentation rules around print management systems.
- Add monitoring for future PaperCut management changes and unexpected outbound traffic.
Bottom line
The PaperCut NG/MF issue is dangerous because it combines active exploitation, management-plane access, and a path toward pre-authentication code execution. Organizations should treat this as an urgent patch-and-hunt event, not simply another product advisory.
If PaperCut sits anywhere near identity, file services, or administrative workflows, defenders should assume the server has enough environmental value to justify immediate remediation and post-patch review.
References
- https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://www.securityweek.com/more-details-emerge-on-exploited-papercut-vulnerabilities/
- https://socradar.io/blog/papercut-rce-cve-2026-82078/
- https://www.esentire.com/security-advisories/apercut-discloses-zero-day-vulnerabilities-cve-2026-82078-and-cve-2026-81578