Threat Overview
On 9 October 2026, watchTowr published a technical reconstruction of the PaperCut NG/MF exploitation chain and successive patch bypasses. The initial in-the-wild chain combined CVE-2026-81578 (unauthenticated access to privileged Tapestry application forms) with CVE-2026-82078 (unsafe Java class loading through database configuration), resulting in server-side code execution. Researchers subsequently found patch bypasses WT-2026-0141 through WT-2026-0143 and a distinct Scan-to-Fax post-authentication RCE, CVE-2026-82077 / WT-2026-0144. The later bypass plus Scan-to-Fax flaw formed a pre-authentication chain against intermediate 26.0.4-PO build 76508; watchTowr reports the bypass was addressed in build 76530 (1 September), and the Scan-to-Fax RCE in 26.0.5 (10 September). This is newly published technical detail about a previously exploited chain, not a claim of new October compromise. The vendor updated its separate September security bulletin on 13 October with 24.x backported fixed releases.
References
watchTowr Labs — technical research, 9 Oct 2026
PaperCut — security bulletin, 24 Sep; updated 13 Oct 2026
BleepingComputer — active exploitation, 28 Aug 2026
Impacted Systems
**Vendor/product:** PaperCut NG and PaperCut MF self-hosted print-management application servers on supported Windows/Linux server operating systems. **Relevant components:** web admin interface / Apache Tapestry request routing; database connection utilities; Scan-to-Fax integration. **Exposure:** reachable administrative web interface, often TCP 9191/9192 (deployment-specific); access through internal networks can also be abused. **Version nuance:** in-the-wild chain confirmed against 26.0.3; 26.0.4 and 26.0.4-PO build 76508 had subsequently demonstrated bypass paths. watchTowr states 26.0.4-PO build 76530 closed the later authentication bypass, and 26.0.5 closed CVE-2026-82077. PaperCut recommends **26.0.5 / 25.0.13 / 24.1.11 or later** as of its 13 October bulletin. **Not the same issue:** PaperCut Hive Ricoh embedded app has a separate physical-access vulnerability; do not include it in this server RCE hunt.
Why this matters
A successful chain can turn an exposed print-management server into a foothold with the application service account privileges. Intermediate emergency patches may not have covered later-discovered paths, making exact installed build validation essential.
Exploitation Status
**Confirmed:** PaperCut and watchTowr documented exploitation in the wild of the original CVE-2026-81578 + CVE-2026-82078 chain in August 2026. **Researcher demonstration:** watchTowr reproduced later patch bypasses and a pre-auth RCE chain against build 76508; this is not evidence that those specific later bypasses were exploited in the wild. **Vendor statement:** PaperCut says it has no evidence of exploitation of CVE-2026-82077 in its separate September bulletin. The two statements refer to different vulnerability sets.
What this hunt looks for
Available Microsoft Sentinel WAF, perimeter HTTP, endpoint process/file/network, SecurityEvent 4688 and Linux Syslog telemetry where those sources are ingested. Windows 4688 command-line auditing and detailed HTTP query strings are prerequisites for some hunts.
Required logs
AzureDiagnostics application gateway/front door WAF URI telemetry; CommonSecurityLog firewall or proxy traffic to PaperCut default web ports; CommonSecurityLog with full HTTP URI or application request in Message; DeviceFileEvents from PaperCut application servers; DeviceNetworkEvents and 30-day endpoint retention; DeviceProcessEvents and DeviceNetworkEvents process IDs; DeviceProcessEvents from onboarded PaperCut servers; SecurityEvent 4688 and command-line audit on PaperCut Windows hosts; Syslog containing PaperCut application or service logs
Hunt 1: First pass — PaperCut Tapestry authentication-bypass and setup-form access
Required telemetry: CommonSecurityLog with full HTTP URI or application request in Message
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Uri=tostring(column_ifexists("RequestURL","")), Detail=tostring(column_ifexists("Message",""))
| where Uri contains "/app" or Detail contains "/app"
| where Uri has_any ("LogonMessage","SetupAdmin","SetupVerify","ConfigEditor","quickFindForm") or Detail has_any ("LogonMessage","SetupAdmin","SetupVerify","ConfigEditor","quickFindForm")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Uri, Detail, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated descHunt 2: Azure WAF — PaperCut setup and privileged-form probes
Required telemetry: AzureDiagnostics application gateway/front door WAF URI telemetry
AzureDiagnostics
| where TimeGenerated >= ago(30d)
| where Category in~ ("ApplicationGatewayFirewallLog","FrontDoorWebApplicationFirewallLog")
| extend Uri=strcat(tostring(column_ifexists("requestUri_s",""))," ",tostring(column_ifexists("requestUri_t",""))," ",tostring(column_ifexists("requestUri","")))
| where Uri contains "/app" and Uri has_any ("LogonMessage","SetupAdmin","SetupVerify","ConfigEditor","ScanFax")
| project TimeGenerated, Resource, Category, Uri, action_s=tostring(column_ifexists("action_s","")), clientIP_s=tostring(column_ifexists("clientIP_s","")), ruleId_s=tostring(column_ifexists("ruleId_s",""))
| order by TimeGenerated descHunt 3: PaperCut Java process spawning operating-system shells
Required telemetry: DeviceProcessEvents from onboarded PaperCut servers
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","java")
| where InitiatingProcessCommandLine contains "papercut" or InitiatingProcessFolderPath contains "PaperCut"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","curl","wget","python","python3")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, SHA256
| order by TimeGenerated descHunt 4: PaperCut installation directory — new Java class and JAR artifacts
Required telemetry: DeviceFileEvents from PaperCut application servers
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath contains "PaperCut"
| where FileName endswith ".class" or FileName endswith ".jar"
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 5: PaperCut Java outbound connections to rare destinations
Required telemetry: DeviceNetworkEvents and 30-day endpoint retention
let Baseline=DeviceNetworkEvents
| where TimeGenerated between (ago(30d)..ago(2d))
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","java")
| where InitiatingProcessCommandLine contains "papercut" or InitiatingProcessFolderPath contains "PaperCut"
| summarize by DeviceId, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated >= ago(2d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","java")
| where InitiatingProcessCommandLine contains "papercut" or InitiatingProcessFolderPath contains "PaperCut"
| where isnotempty(RemoteIP) and RemoteIP !in ("127.0.0.1","::1")
| join kind=leftanti Baseline on DeviceId, RemoteIP
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descHunt 6: Windows Security 4688 fallback — Java to shell on print servers
Required telemetry: SecurityEvent 4688 and command-line audit on PaperCut Windows hosts
SecurityEvent
| where TimeGenerated >= ago(30d) and EventID == 4688
| extend Cmd=tostring(column_ifexists("CommandLine","")), Parent=tostring(column_ifexists("ParentProcessName","")), NewProc=tostring(column_ifexists("NewProcessName",""))
| where Parent contains "java" and (Cmd contains "PaperCut" or NewProc has_any ("cmd.exe","powershell.exe","pwsh.exe"))
| project TimeGenerated, Computer, Account, Parent, NewProc, Cmd
| order by TimeGenerated descHunt 7: Linux Syslog — PaperCut application and Java command anomalies
Required telemetry: Syslog containing PaperCut application or service logs
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("papercut","ScanFax","ConfigEditor","SetupAdmin","jdbc")
| where SyslogMessage has_any ("error","exec","command","shell","unauthorized","driver","password")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated descHunt 8: PaperCut administrative interface — distributed probing and service enumeration
Required telemetry: CommonSecurityLog firewall or proxy traffic to PaperCut default web ports
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (9191,9192)
| summarize Requests=count(), Targets=dcount(DestinationIP), SampleTargets=make_set(DestinationIP,10), Actions=make_set(DeviceAction,6) by SourceIP, bin(TimeGenerated,1h)
| where Requests >= 30 or Targets >= 3
| order by Requests descHunt 9: Process-to-network correlation after PaperCut Java child execution
Required telemetry: DeviceProcessEvents and DeviceNetworkEvents process IDs
let Child=DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","java")
| where InitiatingProcessCommandLine contains "papercut" or InitiatingProcessFolderPath contains "PaperCut"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","python","python3","curl","wget")
| project DeviceId, ProcessId, ChildTime=TimeGenerated, DeviceName, ChildName=FileName, ChildCmd=ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| join kind=inner Child on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where TimeGenerated between (ChildTime .. ChildTime+1h)
| project TimeGenerated, DeviceName, ChildName, ChildCmd, RemoteIP, RemoteUrl, RemotePort
| order by TimeGenerated descDetection Notes
**Highest signal:** PaperCut Java spawning shells; suspicious privileged Tapestry form access followed by process execution; unexpected Java process egress. **Noise:** legitimate PaperCut updates create JAR/class files, admins use setup and troubleshooting forms, and generic Java activity is common. **Critical gaps:** reverse proxies may strip URI query strings, CommonSecurityLog often lacks HTTP paths, Windows 4688 may omit command lines, and Defender device tables may not include the print server. Port 9191/9192 alone does not establish exploitation. Queries were prepared but not executed against a customer workspace.
