PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078 – Active Mass Exploitation

Threat Overview

PaperCut updated its August 27 security bulletin on September 10, 2026 with security maintenance releases after confirming active exploitation and customer incidents affecting PaperCut NG and PaperCut MF. CVE-2026-81578 is an authentication bypass in the web management interface that allows unauthenticated remote requests to modify certain system configuration. CVE-2026-82078 is an unsafe dynamic class loading weakness in database connection utilities that can execute arbitrary Java bytecode under the PaperCut server process when relevant configuration parameters can be manipulated. The two issues can therefore form a practical pre-authentication path from exposed management access to server-side code execution.

GreyNoise independently reported an AI-assisted campaign using 45.142.193.132 to develop, test, and exploit the vulnerabilities and reported hundreds of compromised PaperCut instances across dozens of countries. PaperCut has not published a stable exploit-request signature, so behavioral and post-exploitation evidence is more reliable than guessing a request path or payload.

References

• PaperCut URGENT Security Advisory – last updated September 10, 2026
• GreyNoise – Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF – published September 9, 2026
• PaperCut NG release history – security maintenance releases published September 10, 2026

Impacted Systems

Vendor/products: PaperCut NG and PaperCut MF application servers. Affected versions: PaperCut states the bulletin applies to all versions of PaperCut NG/MF. Fixed supported maintenance releases are 26.0.5, 25.0.13, and 24.1.10. Versions 23 and earlier do not receive these maintenance releases and should be upgraded to a supported fixed branch. Components: web management interface and database connection utilities. Deployment: self-managed PaperCut NG/MF servers; the issues are application-level rather than tied to one server operating system. Exposure: highest when the PaperCut web interface is reachable from the Internet or other untrusted networks. Common PaperCut web ports include 9191, 9192, and 9195, while deployments may also publish services through 80/443. PaperCut Hive and PaperCut Pocket are not affected by this bulletin.

Why this matters

PaperCut servers are commonly centrally deployed and may be reachable from broad internal networks or the Internet. Confirmed exploitation converts this from a patch-only issue into an incident-hunting priority. Successful server-side execution can expose credentials, print-management data, adjacent systems, and administrative trust relationships.

Exploitation Status

Confirmed active exploitation. PaperCut states it is aware of confirmed customer incidents and continues to investigate active exploitation. GreyNoise observed a likely Russian-speaking actor developing and using exploits beginning August 31. The GreyNoise IP is an observed campaign indicator, not a universal exploit source.

What this hunt looks for

Suspicious child processes of the PaperCut application server process, observed campaign infrastructure reaching known PaperCut systems, new or high-rate sources reaching PaperCut web services, PaperCut-created executable/script files, PaperCut server log deletion or rename activity, rare outbound destinations from PaperCut processes, and Windows process-creation fallbacks.

Required logs

• Microsoft Defender XDR / Defender for Endpoint process, file, and network telemetry for the strongest host-level hunts.
• CommonSecurityLog or equivalent firewall/WAF telemetry covering known PaperCut server IPs and web ports.
• Windows SecurityEvent 4688 with command-line capture for the process-creation fallback.
• PaperCut application/server logs improve confidence, especially for log-tampering validation.

First Pass – PaperCut Server Process Spawning Shells or Network Utilities

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app") or InitiatingProcessCommandLine has "PaperCut"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","sh","bash","curl","wget")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated desc

GreyNoise-Observed Exploitation Source Reaching Known PaperCut Servers

let PaperCutIPs = dynamic(["REPLACE_WITH_PAPERCUT_SERVER_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (PaperCutIPs)
| where SourceIP == "45.142.193.132"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Protocol, DeviceAction, Activity, Message
| order by TimeGenerated desc

New Sources Reaching PaperCut Web Services

let PaperCutIPs = dynamic(["REPLACE_WITH_PAPERCUT_SERVER_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (PaperCutIPs)
| where DestinationPort in (80,443,9191,9192,9195)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (PaperCutIPs)
| where DestinationPort in (80,443,9191,9192,9195)
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

High-Rate Requests to PaperCut Web Services

let PaperCutIPs = dynamic(["REPLACE_WITH_PAPERCUT_SERVER_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (PaperCutIPs)
| where DestinationPort in (80,443,9191,9192,9195)
| summarize Connections=count(), Actions=make_set(DeviceAction,20), Ports=make_set(DestinationPort,10) by SourceIP, DestinationIP, bin(TimeGenerated,5m)
| where Connections >= 50
| order by Connections desc

PaperCut Process Creating Executables or Scripts

DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app") or InitiatingProcessCommandLine has "PaperCut"
| where ActionType in~ ("FileCreated","FileRenamed")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".js" or FileName endswith ".vbs" or FileName endswith ".hta" or FileName endswith ".bat" or FileName endswith ".cmd" or FileName endswith ".sh" or FileName endswith ".jar"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

PaperCut server.log Deletion or Rename

DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "server.log"
| where FolderPath has "PaperCut"
| where ActionType in~ ("FileDeleted","FileRenamed")
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Rare Outbound Destinations From PaperCut Server Processes

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app") or InitiatingProcessCommandLine has "PaperCut"
| summarize by DeviceId, RemoteUrl, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where InitiatingProcessFileName in~ ("pc-app.exe","pc-app") or InitiatingProcessCommandLine has "PaperCut"
| join kind=leftanti Baseline on DeviceId, RemoteUrl, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| order by TimeGenerated desc

Windows SecurityEvent Fallback for PaperCut Child Processes

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4688
| where ParentProcessName endswith @"\pc-app.exe"
| where NewProcessName has_any (@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\rundll32.exe",@"\regsvr32.exe",@"\mshta.exe",@"\wscript.exe",@"\cscript.exe",@"\certutil.exe",@"\bitsadmin.exe",@"\curl.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Detection Notes

Highest signal is unexpected command interpreters or network utilities launched by pc-app.exe, especially when combined with new inbound sources or new outbound destinations. The GreyNoise IP is useful as a narrow IOC but should not be treated as the complete campaign. PaperCut has not published a deterministic exploit request path, so generic web-port queries indicate exposure/anomaly rather than exploitation. DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents require Defender XDR/MDE telemetry. The SecurityEvent fallback requires Event ID 4688 process-creation auditing and command-line capture. CommonSecurityLog must contain traffic to the actual PaperCut server IPs. If application server endpoint telemetry, PaperCut logs, WAF logs, or upstream network telemetry are not ingested, successful exploitation may be invisible in Sentinel.