Threat actors are actively exploiting two chained security vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. The attack chain allows an unauthenticated attacker to gain remote control over PaperCut's trusted configuration subsystem. Once exploited, attackers can execute arbitrary Java code within the application context. PaperCut has responded by releasing an emergency patch with additional hardening measures. The vulnerabilities are particularly severe as they require no authentication, significantly lowering the barrier for exploitation. Organizations running vulnerable versions of PaperCut NG and MF are urged to apply the emergency fix immediately. The chaining of two flaws to achieve full RCE is indicative of sophisticated exploitation techniques being leveraged in the wild.
Attackers are chaining two vulnerabilities in PaperCut NG and MF to achieve unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8) is an improper access control flaw in the web management interface that allows unauthenticated remote requests to trigger backend administrative actions before access validation completes, effectively bypassing authentication. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class loading vulnerability in the database connection utilities where the application instantiates database driver classes based on configurable driver names without validating against an allowlist, enabling arbitrary Java code execution. The attack chain works as follows: CVE-2026-81578 is used to bypass authentication, then a configuration file is edited to exploit CVE-2026-82078 for Remote Code Execution. A crafted request can reference one page for rendering the response and another page owning the component or action being executed, causing PaperCut's authorization check to trust the rendered page while missing the permissions required by the component behind it. Post-exploitation activity includes execution of Base64-encoded commands, deployment of an OS-agnostic Java .class file that fingerprints the machine (running 'whoami & ver' or 'whoami & ver & tasklist'), obtains a directory listing, writes results to a file named 'Udydn.out' in '/data/content/' relative to the installation directory, and then deletes 'Udydn.out', 'server.log', and '/data/internal/derby.log' to cover tracks. watchTowr also discovered multiple patch bypasses and an additional authentication bypass vulnerability, with new patch bypasses identified even in the latest fully patched version.
1. Apply the latest emergency patch from PaperCut immediately (including the second emergency patch with additional hardening). 2. Remove public internet exposure of PaperCut Application Server web interface where possible. 3. Restrict PaperCut Application Server web access to trusted IP addresses only, or place it behind a VPN or another controlled administrative path. 4. Hunt for signs of compromise by searching log files for 'Database error looking up cardID: VALUES CAST' errors. 5. Check for the presence of 'Udydn.out' file in the /data/content/ path relative to the PaperCut installation directory. 6. Review server.log and /data/internal/derby.log for anomalous entries or unexpected deletion. 7. Monitor for Base64-encoded command execution and suspicious Java .class file deployments. 8. Look for execution of 'whoami & ver' or 'whoami & ver & tasklist' commands in process logs. 9. Continue monitoring for new patch bypasses as watchTowr has identified bypasses affecting fully patched versions.
[object Object], [object Object], [object Object], [object Object], [object Object], [object Object], [object Object], [object Object]
