CVE-2026-81578: CWE-305 Authentication bypass by primary weakness in PaperCut PaperCut MF/NG

CVE-2026-81578 is an authentication bypass vulnerability (CWE-305) in PaperCut MF/NG affecting multiple version ranges (>=0 <24.1.10, >=25.0.0 <25.0.13, >=26.0.0 <26.0.5). Exploited on August 31, 2026, attackers targeted an internet-facing print server running version 24.0.2, deploying an in-memory Java loader that established a web shell. Through this web shell, a trojanized Microsoft Copilot binary containing an AdaptixC2 implant was delivered, connecting to C2 infrastructure hosted on Alibaba servers. After a dormant period, attackers conducted reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials from memory and registry, enabled Windows Restricted Admin mode to facilitate pass-the-hash attacks, and extracted the NTDS.dit database containing password hashes for all domain accounts, achieving complete domain compromise.

Successful exploitation allows attackers to bypass authentication on PaperCut MF/NG print servers, deploy persistent web shells, and deliver advanced malware implants. This leads to full domain compromise through credential theft, lateral movement, and extraction of sensitive Active Directory data, severely impacting confidentiality, integrity, and availability of enterprise networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, organizations should monitor for updates from PaperCut and apply any official fixes promptly once available. In the meantime, restrict internet-facing access to PaperCut MF/NG servers and monitor for suspicious activity related to print server processes.