PaperCut Zero-Days: Two Bugs, Two Patches, One Bad Weekend

Print servers are the plumbing of an office. Nobody thinks about them until something backs up, and by the time you notice the smell, it's already under the floorboards. That's more or less where PaperCut administrators found themselves over the last week of August, staring at an emergency patch that needed its own emergency patch before the ink was dry.

Two zero-days. Two fixes in a single day. And a security firm quietly noting that patch bypasses were already sitting on the workbench before the first release even shipped.

What Happened

The timeline is tight and worth walking through in order. On August 26, Huntress observed the first exploitation attempts against PaperCut NG/MF customers. The following day, PaperCut Software issued a security bulletin. On August 28, the vendor pushed an emergency patch for versions 25 and 26, and then, later the same day, pushed a second emergency patch adding hardening for version 24.

As SecurityWeek reported, what looked initially like a single zero-day turned out to be two. The second patch was triggered by WatchTowr, which found multiple patch bypasses and an additional authentication bypass flaw on top of the ones PaperCut was already trying to close.

The pipes, in other words, weren't just leaking. There was a second leak upstream nobody had spotted.

The two CVEs at the heart of this are CVE-2026-81578, a high-severity authentication bypass that lets a remote, unauthenticated attacker modify certain system configurations, and CVE-2026-82078, a critical issue involving unsafe dynamic class loading in the database connection utilities. PaperCut noted on Sunday that its teams were still working on an official release that fully patches both. Indicators of compromise have been published.

Huntress has confirmed attacks against at least two customers so far. The observed activity focused on system discovery, with no secondary malware, no command-and-control traffic, and no persistence from the recovered payload. Who's behind it and why remains unclear. Roughly 1,000 PaperCut instances are currently exposed to the internet, a majority in North America and Europe, per ShadowServer Foundation data.

Technical Anatomy

The interesting bit here isn't either bug on its own. It's the chain. CVE-2026-81578 gives you the ability to change system configuration parameters without authenticating. CVE-2026-82078 lets those configuration parameters influence dynamic class loading in the database connection utilities. Put them together and, in PaperCut's own words: "If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process."

That's the whole plumbing problem in one sentence. The auth bypass isn't the payoff. The auth bypass is the wrench that lets you unscrew the joint. Once you can rewrite config, the class loader becomes your remote code execution primitive, running under whatever privileges the PaperCut service holds. On a typical deployment, that's not a locked-down role. Print management servers historically run with broad file system access, network reach into user directories, and often domain-joined credentials.

Anyone who has stared at a Java classpath at 3am trying to figure out why the wrong version of a JAR is being picked up knows the shape of this vulnerability class. Unsafe dynamic class loading has been a recurring category of pain going back to the Log4Shell era, and it lives in the same neighbourhood as deserialization bugs and template injection. The OWASP guidance on this pattern has been consistent for years: never let untrusted input decide which class to load.

The reason WatchTowr's follow-up findings matter so much is that patch bypasses in a config-parameter-driven bug are almost inevitable when the first fix is scoped narrowly. If you patch by blocking specific parameter names, you leave the shape of the vulnerability intact and only close the specific doorway the researcher happened to walk through. That's how you end up shipping two patches in one day. The second one, presumably, addresses the pattern rather than the instance.

PaperCut's advisory language, still working on an official release, tells you the vendor itself considers this an in-progress fix. Treat any patched box as reduced-risk, not clean.

Who Gets Burned

Print management sounds like an IT problem, not a security one. That's the trap. PaperCut NG/MF is deployed heavily in universities, hospitals, law firms, government agencies, and mid-sized enterprises: the exact environments where a compromised internal server can pivot into HR data, financial records, or patient information within an afternoon.

Roughly 1,000 exposed instances sitting on the public internet is the immediate headline number, but the real exposure is larger. Most PaperCut servers live behind the firewall, which means external scanning undercounts them. Any attacker with initial access to a corporate network, phished credentials, VPN foothold, compromised contractor laptop, now has a well-documented, well-published path to code execution on a server that likely holds service account credentials with broad reach.

History is not kind here. CISA's KEV catalog already contains three other PaperCut flaws. Two of those have been exploited in ransomware attacks. The Cl0p and LockBit campaigns of 2023 against PaperCut instances are still fresh enough that most incident responders can quote the IoCs from memory. Ransomware operators love products like this: high privilege, low patch cadence, low visibility from SOC tooling.

The verticals I'd worry about most in the next 90 days are healthcare and higher education, both because they run PaperCut heavily and because they historically patch slowly. Legal and financial services shops running PaperCut on-prem, particularly the smaller ones without dedicated vulnerability management, are the next tier. Managed print service providers hosting PaperCut for multiple client tenants are the softest and juiciest target of the lot: one compromise, many downstream victims.

The fact that observed activity so far is just discovery is not comforting. That's what the opening move looks like before the interesting one.

Playbook for Security Teams

This week, if you run PaperCut anywhere, treat it as compromised until proven otherwise. Apply the second emergency patch, not just the first. Pull the IoCs PaperCut has published and hunt against them across at least 30 days of logs, given the first observed exploitation was August 26 and reconnaissance activity tends to precede public disclosure.

Get the server off the public internet. There is no legitimate reason for a print management console to be exposed to arbitrary IPs. Put it behind a VPN, a reverse proxy with mutual TLS, or an identity-aware access proxy. If ShadowServer's roughly 1,000 exposed instances includes yours, that's the single highest-use change you can make today.

Rotate any service account credentials the PaperCut server holds. Domain-joined print servers frequently cache credentials that are useful far beyond printing. Assume any secrets on the box are burned.

Segment the server. Print management does not need lateral network access to your finance systems, your source control, or your identity provider. If it currently has that access, fix the network policy before you fix anything else. Look up both CVEs in the MITRE database as details are finalised, and wire your detection rules to the class-loading behaviour, not just the specific parameter names in the current advisory.

Finally, brief your leadership. Two patches in a day, a vendor still finalising the official fix, and confirmed active exploitation is exactly the kind of situation that ends up in a board meeting three weeks late. Get ahead of it now.

Key Takeaways

• Two zero-days, CVE-2026-81578 and CVE-2026-82078, chain an authentication bypass into arbitrary Java bytecode execution under the PaperCut server's security context.
• PaperCut shipped two emergency patches on August 28 after WatchTowr found bypasses in the first fix. The vendor is still working on the official complete release.
• Huntress observed the first exploitation on August 26, currently limited to system discovery activity against at least two customers, with no follow-on payloads yet.
• Roughly 1,000 PaperCut instances are internet-exposed per ShadowServer, mostly in North America and Europe. Two prior PaperCut flaws in CISA's KEV have already been used in ransomware.
• Patch to the second emergency release, pull the box off the public internet, rotate service credentials, and hunt against PaperCut's published IoCs going back at least 30 days.

Back to the plumbing. When a leak springs and the plumber's second fix goes in before the first one has fully set, you don't celebrate that the drip has stopped. You check the ceiling downstairs for stains. PaperCut administrators should be doing exactly that this week: assuming water has already reached somewhere it shouldn't, and looking for it, rather than trusting the pipes are dry.