PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078 Active Pre-Auth RCE Chain

Threat Overview

PaperCut disclosed additional technical details on August 28, 2026 for the actively exploited PaperCut NG/MF incident first announced the prior day. Two vulnerabilities are now tracked as CVE-2026-81578 and CVE-2026-82078 and can be chained to bypass authentication and execute code on vulnerable PaperCut Application Servers.

CVE-2026-81578 is an authentication-bypass issue in the PaperCut NG/MF web management interface. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes. CVE-2026-82078 is an unsafe dynamic class-loading issue in PaperCut database connection utilities. If an attacker can manipulate configuration parameters, arbitrary Java bytecode present on the application classpath can execute under the PaperCut server process security context.

Huntress observed exploitation in two customer environments and reproduced the complete pre-authentication RCE chain. PaperCut logs captured reconnaissance commands, and Huntress reported hex-encoded Java class content used as an execution bridge between PaperCut and the operating system. PaperCut described the activity as limited and targeted at the time of reporting and had not publicly attributed the attacks.

References

Impacted Systems

Vendor / Product	PaperCut NG and PaperCut MF
Vulnerabilities	CVE-2026-81578 authentication bypass; CVE-2026-82078 unsafe dynamic class loading
Affected role	PaperCut Application Server; PaperCut also directs customers to update Site Servers and secondary/print servers
Supported emergency patch branches	PaperCut NG/MF versions 24, 25, and 26 have Emergency Patch Release 2 available
Version 23 and earlier	Upgrade to the latest supported version
Platform	Windows, Linux, and macOS server deployments
Not affected	Print Deploy and Mobility Print
Exposure of greatest concern	Web management interfaces reachable from the public Internet or untrusted networks
Known exploitation	Confirmed; PaperCut and Huntress reported real customer exploitation
Observed post-exploitation	Reconnaissance commands and Java class content used to bridge execution into the operating system
Remediation	Install Emergency Patch Release 2 even if Release 1 was already applied; keep web interfaces restricted to trusted IPs

Why this matters

PaperCut Application Servers are frequently integrated with identity, printing, directory, and administrative infrastructure. The demonstrated pre-authentication RCE chain gives an Internet-based attacker a direct path to code execution under the PaperCut service context. The additional patch-bypass findings also mean environments that installed only the first emergency patch remain a priority.

Exploitation Status

Confirmed active exploitation. PaperCut reported customer incidents; Huntress observed exploitation in two customer environments and reproduced the chain. At the time of reporting, the attacks appeared limited and targeted and no threat actor attribution was confirmed.

What this hunt looks for

PaperCut-specific HTTP exposure, suspicious child processes from pc-app.exe or Java, PaperCut log tampering and vendor-published error strings, Java class-file creation, unusual public network connections from PaperCut processes, and short-window process-to-network correlations.

Required logs

DeviceProcessEvents
DeviceFileEvents
DeviceNetworkEvents
CommonSecurityLog
Syslog
SecurityEvent — Event ID 4688 fallback

Hunt 1 — First-Pass: Suspicious Child Processes Spawned by PaperCut

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app","java.exe","java")
| where InitiatingProcessCommandLine has_any ("papercut","server") or InitiatingProcessFileName in~ ("pc-app.exe","pc-app")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","curl.exe","curl","wget.exe","wget","python.exe","python","bash","sh","dash","perl")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 2 — Vendor-Reported server.log Deletion or Modification

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "server.log"
| where FolderPath has "PaperCut"
| where ActionType in ("FileDeleted","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated asc

Hunt 3 — Vendor-Reported PaperCut Database Error Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("No suitable driver found for jdbc:no:x","DatabaseUtils - Database error looking up cardID: VALUES CAST")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 4 — Java Class or Script Files Created by PaperCut/Java

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app","java.exe","java")
| where FileName endswith ".class" or FileName endswith ".jar" or FileName endswith ".jsp" or FileName endswith ".ps1" or FileName endswith ".bat" or FileName endswith ".cmd" or FileName endswith ".sh" or FileName endswith ".exe" or FileName endswith ".dll"
| where FolderPath has_any ("PaperCut","\\Temp\\","/tmp/","/var/tmp/")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated asc

Hunt 5 — Internet Sources Reaching PaperCut Web Interfaces

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (9191,9192) or DestinationHostName has "papercut" or RequestURL has_any ("papercut","/admin","/app")
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Methods=make_set(RequestMethod,20), URLs=make_set(RequestURL,50), UserAgents=make_set(RequestClientApplication,20), Actions=make_set(DeviceAction,20) by SourceIP, DestinationHostName, DestinationIP, DestinationPort
| sort by Requests asc

Hunt 6 — Rare Public Destinations From PaperCut or Java

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app","java.exe","java")
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app","java.exe","java")
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteUrls=make_set(RemoteUrl,20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| sort by FirstSeen desc

Hunt 7 — Suspicious PaperCut Child Process Followed by Public Network Activity

let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app","java.exe","java")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","curl.exe","curl","wget.exe","wget","python.exe","python")
| project DeviceId, DeviceName, ProcessTime=TimeGenerated, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIPType == "Public"
| join kind=inner SuspiciousChildren on DeviceId
| where TimeGenerated between (ProcessTime .. ProcessTime + 10m)
| project ProcessTime, TimeGenerated, DeviceName, ChildProcess, ChildCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by ProcessTime asc

Hunt 8 — Windows 4688 Fallback for PaperCut-to-Shell Execution

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName endswith @"\pc-app.exe" or ParentProcessName endswith @"\java.exe"
| where NewProcessName endswith @"\cmd.exe" or NewProcessName endswith @"\powershell.exe" or NewProcessName endswith @"\pwsh.exe" or NewProcessName endswith @"\rundll32.exe" or NewProcessName endswith @"\certutil.exe"
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Detection Notes

Highest-signal hunts are suspicious child processes from pc-app.exe, vendor-published server.log indicators, and class/script creation by PaperCut or its Java runtime.
Do not treat installation of Emergency Patch Release 1 as sufficient; PaperCut specifically directed customers to install Emergency Patch Release 2.
HTTP telemetry may not reveal the exact exploit request because technical request details were intentionally limited during the active incident.
Broad Java process hunting can be noisy. Scope to confirmed PaperCut servers or an asset watchlist whenever possible.
Missing PaperCut server.log telemetry materially reduces visibility into the vendor-published indicators.