Safa Marwah
In a critical development for enterprise security, PaperCut has deployed an unprecedented second emergency security update to address actively exploited vulnerabilities within its widely used PaperCut NG and MF print management software. This rapid re-release became imperative after independent security researchers identified multiple pathways to circumvent the initial corrective measures, exposing organizations to continued risk from sophisticated threat actors leveraging these flaws in zero-day attacks. The necessity of a follow-up patch underscores the persistent challenge in securing complex software systems against determined adversaries and highlights the dynamic nature of contemporary cyber threats.
The unfolding situation began with an urgent advisory from PaperCut, warning customers of an active exploitation campaign targeting critical vulnerabilities in their print management solutions. Initial intelligence indicated that malicious actors were leveraging undisclosed flaws to compromise customer servers. In response, the company swiftly released its first emergency patch for PaperCut NG/MF versions 25 and 26. At that juncture, specific Common Vulnerabilities and Exposures (CVE) identifiers and granular technical details were intentionally withheld, a common practice designed to afford customers a critical window to apply patches before attackers could fully weaponize detailed vulnerability information. This strategic delay aimed to minimize immediate exposure while internal security teams and external partners meticulously investigated the scope and nature of the attacks.
Subsequently, PaperCut disseminated comprehensive technical details, assigning two distinct CVE identifiers to the vulnerabilities: CVE-2026-81578 and CVE-2026-82078. These vulnerabilities, when chained together, facilitate a potent attack vector allowing unauthenticated access and subsequent remote code execution on vulnerable servers. This combination represents a severe security risk, as it bypasses standard authentication protocols and permits attackers to execute arbitrary commands within the compromised environment, potentially leading to widespread system compromise or data exfiltration.
The first identified flaw, CVE-2026-81578, is categorized as a high-severity authentication bypass vulnerability, scoring 8.8 on the CVSS scale, impacting the PaperCut NG/MF web management interface. This vulnerability stems from a design weakness where, under specific operational conditions, remote requests targeting administrative functionalities can initiate backend actions prematurely, before the application fully validates user access credentials. Effectively, an attacker can trick the system into processing certain commands as if they were authorized, circumventing the intended security checks. This pre-authentication action allows an attacker to manipulate the application’s state or access sensitive resources without legitimate credentials, laying the groundwork for further exploitation.
Complementing this, CVE-2026-82078 is a critical unsafe dynamic class-loading vulnerability, boasting a severe CVSS score of 9.4. This flaw resides within PaperCut’s database connection utilities. The core issue lies in the application’s mechanism for loading database driver classes, which relies on configurable driver names. Critically, these driver names are not adequately validated against an approved allowlist. Consequently, if a malicious actor successfully manipulates system configuration parameters to inject arbitrary driver names, the application can be coerced into executing arbitrary Java bytecode. This bytecode, residing on the application classpath, would then run under the elevated security context of the PaperCut server process, granting the attacker extensive control over the system. The chaining of these two vulnerabilities creates a powerful exploit path: the authentication bypass (CVE-2026-81578) grants an attacker the ability to manipulate configuration parameters, which then enables the dynamic class-loading flaw (CVE-2026-82078) to achieve unauthenticated remote code execution. Cybersecurity firm watchTowr, a key collaborator in the incident response, confirmed that their researchers successfully reproduced these chained vulnerabilities, demonstrating the ease with which unauthenticated attackers could gain full control over affected PaperCut NG/MF instances.
The release of Emergency Patch Release 2 on Friday underscores the gravity and evolving nature of the threat. This updated security fix incorporates additional hardening measures, developed through intensive collaboration between PaperCut’s internal security team and external researchers, notably from Huntress and watchTowr. The initial emergency patch, while addressing the immediate reported exploits, proved insufficient against the diligent efforts of security researchers who quickly uncovered multiple bypasses and even identified an additional authentication bypass vulnerability. This rapid discovery necessitated an even more robust defensive posture. PaperCut has issued a strong directive, urging all customers to install Release 2 without delay, irrespective of whether they had already deployed the initial emergency patch. The imperative for this second release highlights the iterative process often involved in addressing sophisticated vulnerabilities, where initial fixes may not fully anticipate all potential exploitation vectors or underlying systemic weaknesses.
Emergency Patch Release 2 is now available for PaperCut NG and MF versions 24, 25, and 26, encompassing Windows, Linux, and macOS platforms. Organizations operating on older versions (23 or earlier) are strongly advised to forgo waiting for a patch specific to their legacy releases and instead prioritize upgrading to the latest patched version. Furthermore, the updated security measures extend beyond the primary application server; Site Servers and secondary/print servers are also mandated for upgrade to the patched versions to ensure comprehensive protection across the print infrastructure. Other ancillary components, such as Print Deploy and Mobility Print, have been determined to be unaffected by these particular vulnerabilities and therefore do not necessitate immediate updates.
Beyond the critical application of patches, PaperCut has emphasized the importance of implementing robust network-level security controls. Even with the latest fixes, customers are strongly encouraged to restrict access to the web interfaces of their PaperCut installations to a defined list of trusted IP addresses. This can be achieved through judicious configuration of firewall rules, network access controls, or equivalent security mechanisms. This layered security approach serves as a crucial defensive barrier, limiting the attack surface even if future vulnerabilities or unforeseen bypasses emerge.
Administrators are also advised to proactively monitor their environments for indicators of compromise (IoCs) that may signal successful exploitation. Key forensic artifacts to scrutinize include suspicious post-exploitation activity originating from the pc-app.exe process, which is the core PaperCut application executable. Anomalies in log files, such as missing or truncated server.log files, can also indicate malicious activity aimed at covering tracks. Specific error messages within the server.log, such as "ERROR No suitable driver found for jdbc:no:x" or "ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST," have been identified as potential indicators of attempts to trigger the unsafe dynamic class-loading vulnerability.
The identity of the threat actors behind these attacks and their specific post-compromise objectives remain under active investigation. PaperCut has indicated that the attacks appear to be limited and highly targeted. The company is deliberately withholding granular details about the post-exploitation activities to avoid prematurely disclosing intelligence that could hinder ongoing investigations or compromise the response efforts of affected customers. However, they have committed to publishing verified indicators of compromise as soon as they are thoroughly validated, ensuring that security teams have the necessary intelligence to detect and remediate potential intrusions.
This incident is not an isolated event for PaperCut. In 2023, PaperCut servers became a significant target for various threat actors following the exploitation of CVE-2023-27350, another critical authentication bypass and remote code execution vulnerability. That previous wave of attacks was notably linked to a diverse array of sophisticated adversaries, including prominent ransomware operations such as Clop and LockBit, state-sponsored hacking groups purportedly backed by Iran, and the financially motivated Bl00dy Ransomware Gang. The recurring targeting of PaperCut’s software underscores the critical importance of print management systems within enterprise networks. Often overlooked in comprehensive security assessments, these systems typically reside deep within internal networks, possess high privileges, and handle a constant flow of sensitive documents, making them highly attractive entry points for adversaries seeking to establish persistence, exfiltrate data, or deploy ransomware.
The repeated exploitation of PaperCut’s software highlights several profound implications for cybersecurity strategies. Firstly, the rapid discovery of patch bypasses emphasizes the critical role of independent security research and the necessity for vendors to engage closely with the broader security community. The collaborative effort between PaperCut, Huntress, and watchTowr in this instance exemplifies an effective model for rapid incident response and iterative vulnerability remediation. Secondly, the incident underscores the pervasive challenge of securing complex, widely deployed software. Even with diligent development practices, sophisticated vulnerabilities can emerge, requiring swift and comprehensive action.
For organizations, this event serves as a stark reminder of the imperative for a multi-layered security posture. While patching is fundamental, it cannot be the sole defense. Robust network segmentation, stringent access controls, comprehensive logging and monitoring, and continuous threat hunting are essential components of an effective security strategy. Organizations must assume that internal systems, including those traditionally considered less critical like print management, can become prime targets. Regular security audits, penetration testing focused on internal infrastructure, and an incident response plan capable of addressing zero-day exploits are no longer optional but critical necessities. The ongoing evolution of the threat landscape demands perpetual vigilance and a proactive approach to cybersecurity, recognizing that even patched systems require continuous scrutiny against novel attack vectors and persistent threats.
Lisa Mariana
Aura Kasih
Ayu Aulia
