PaperCut releases second emergency patch for exploited flaws

Two vulnerabilities in PaperCut NG/MF software, CVE-2026-81578 and CVE-2026-82078, enable unauthenticated remote attackers to bypass authentication and achieve remote code execution. CVE-2026-81578 is an authentication bypass in the web management interface allowing backend actions before access validation completes. CVE-2026-82078 is a critical flaw in database connection utilities where unsafe dynamic class loading without an allowlist enables arbitrary Java bytecode execution. Initial emergency patches were bypassed, leading to a second emergency patch with additional hardening. Exploitation has been confirmed in the wild, with attackers performing system reconnaissance but no confirmed malware deployment or persistence. PaperCut recommends applying the second emergency patch for versions 24, 25, and 26 and upgrading older versions. Network access restrictions and monitoring for suspicious activity are also advised.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and execute arbitrary code on PaperCut NG/MF servers. This compromises the confidentiality, integrity, and availability of affected systems. Observed attacker activity has included system reconnaissance commands, but no confirmed malware deployment or persistence has been reported. The vulnerabilities pose a critical risk due to remote code execution capabilities and active exploitation in customer environments.

PaperCut has released a second emergency patch (Release 2) that includes additional hardening beyond the initial emergency patch. Customers running PaperCut NG/MF versions 24, 25, and 26 on Windows, Linux, and macOS should immediately apply this updated patch. Customers with versions 23 or earlier should upgrade to the latest version rather than wait for a patch. Additionally, restrict access to the PaperCut web management interfaces to trusted IP addresses using firewall rules or network access controls. Administrators should monitor for suspicious post-exploitation activity, including anomalies in the pc-app.exe process and specific error messages in server logs. PaperCut continues to investigate post-compromise activity and will provide indicators of compromise as they are verified.