PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)

What to do

1. Upgrade every PaperCut NG/MF Application Server, Site Server and secondary server to 26.0.5, 25.0.13 or 24.1.10, and schedule the move off version 23 or earlier now.
2. Restrict the Application Server's web interfaces to trusted internal addresses and remove any internet exposure.
3. On any server that was exposed while unpatched, capture a JVM heap or memory dump and copy the logs before restarting, because in-memory web shells vanish on restart.
4. Check the external user-lookup settings (user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql) for values you did not set.
5. If you find indicators, rebuild the Application Server from a clean pre-incident backup and reset domain credentials the server could reach.
6. Patch Active Directory against noPac (CVE-2021-42278/42287) if you have not, since attackers used it to reach domain admin after PaperCut.

How to check if you are affected or compromised

• Search server.log for 'No suitable driver found for jdbc:no:x', 'jdbc:derby:memory:pwn' or 'looking up cardID: VALUES CAST', and treat a missing or truncated server.log as suspicious.
• Look for pc-app.exe (or pc-app) spawning cmd.exe or PowerShell, such as 'whoami & ver', tasklist or nltest /dclist:, and for 5-character .class files in server\lib with .cmd/.out files in server\data\content.
• Search web logs for /app?service=direct/... requests chaining LogonMessage with ConfigEditor, UserList or SetupAdmin, and POST bodies setting org.h2.Driver or jdbc:h2:mem:.
• Check for a 'Remote Access Service' (SimpleHelp) service, unexpected AnyDesk, an Administrator17 account, C:\ProgramData\ligolo-agent.exe, or traffic to 45.142.193.132, 45.158.196.75, 103.124.105.161 or 107.180.182.122.

What happened#

On August 27, 2026, PaperCut published an urgent bulletin about active exploitation of PaperCut NG and MF. According to CEO Chris Dance, an education customer reported a compromised MF server that morning. Huntress had already seen exploitation in a customer environment on August 26. PaperCut then disclosed two chained bugs:

• CVE-2026-81578 (CWE-306, vendor CVSS 4.0 8.8; NVD CVSS 3.1 9.8). Unauthenticated requests to admin functions "can trigger backend actions prior to the completion of access validation checks." This lets an attacker change system configuration.
• CVE-2026-82078 (CWE-470, CVSS 4.0 9.4). The database connection code loads driver classes by configurable name without an allowlist. Once the configuration is changed, this lets an attacker run arbitrary Java bytecode as the PaperCut server process.

watchTowr traced the bypass to page handling. The authorization check ran only for the first page named in a request, such as the unauthenticated LogonMessage, so an admin form nested after it, such as ConfigEditor, was reachable without logging in. Rapid7 says the attacker rewrites the external user-lookup settings, points them at a malicious JDBC URL, and then triggers a lookup. Huntress's proof of concept ran code as SYSTEM under pc-app.exe.

The first emergency patch (Aug 28) could be bypassed. PaperCut followed with Release 2 the same day, Release 3 on September 1, and maintenance releases 26.0.5, 25.0.13 and 24.1.10 on September 10. A Metasploit module was merged on September 3. CISA added both CVEs to KEV on August 31, with a due date of September 14. watchTowr later found a third bug, CVE-2026-82077, a post-authentication RCE through Scan to Fax. It is fixed in 26.0.5 and not known to be exploited.

Exploitation was broad. GreyNoise tracked a likely Russian-speaking actor that "used OpenAI's Codex with a DeepSeek model" to diff the patch and build tooling. The actor's first remote code execution against a real target came on August 31, and the full campaign launched on September 1. GreyNoise counted "at least 440 instances" at 395 organizations in 48 countries, with domain admin reached at 12 of them, in part through noPac where AD was unpatched. watchTowr saw in-memory Godzilla web shells installed as servlet filters on August 31, and more than 1,000 exploit attempts against its sensors.

Who is affected#

PaperCut says all versions of NG and MF are affected, including Site Servers and secondary servers. Versions 23 and earlier get no patch. Huntress says about 47% of the roughly 2,500 PaperCut installations it tracks run v23 or older. Hive, Pocket, Mobility Print, Print Deploy and the client software are not affected. GreyNoise notes that PaperCut servers run as SYSTEM on Windows by default and are usually domain-joined.

Do you really need to act?#

Yes. The chain needs no credentials, a public exploit exists, and attackers hit hundreds of organizations within days. PaperCut says unpatched servers that remain publicly reachable "continue to be targeted." Patching does not remove an existing in-memory shell, a dropped remote-access tool or harvested domain credentials. If your server faced the internet before you installed Release 3 or a maintenance release, treat it as compromised until you have checked. Internal-only servers are lower risk, but still upgrade them now.

What to do now#

1. Upgrade the Application Server, then every Site Server and secondary server, to 26.0.5, 25.0.13 or 24.1.10. If you are on version 23 or earlier, upgrade to a supported line.
2. Firewall the Application Server's web interfaces so only trusted internal addresses can reach them.
3. Before restarting an exposed server, capture a JVM memory dump (for example jcmd <pid> GC.heap_dump <file> where a JDK is available) and copy the logs.
4. Review the external user-lookup settings for values you did not set. If you really use external card-number lookups, apply the server/security.properties change PaperCut documents; otherwise leave the feature off.
5. If anything looks wrong, follow PaperCut's guidance to rebuild from a clean pre-incident backup and start incident response, including resetting domain credentials the server could reach.

How to tell if you were hit#

On Windows, run findstr /S /C:"jdbc:no:x" /C:"jdbc:derby:memory:pwn" /C:"VALUES CAST" "<install>\server\server.log*", or use grep -rE on Linux. A missing or truncated server.log is itself a warning sign. Look for pc-app.exe spawning cmd.exe, 5-character .class files in server\lib, and a service running SimpleService.exe (Get-CimInstance Win32_Service | ? PathName -like '*SimpleService*'). Search web logs for LogonMessage/ConfigEditor or Home/SetupAdmin in the service= parameter, and for org.h2.Driver in POST bodies. Then check the IPs, files and the Administrator17 account listed in the detection panel.

Timeline#

• Aug 26, 2026 — Huntress observes exploitation in a customer environment.
• Aug 27, 2026 — A customer reports a compromise, and PaperCut publishes its bulletin.
• Aug 28, 2026 — Emergency Patch 1, a bypass of it, and Release 2. The CVEs are published.
• Aug 31, 2026 — CISA adds both CVEs to KEV. GreyNoise and watchTowr observe successful exploitation.
• Sep 1, 2026 — PaperCut ships Release 3, and the mass campaign launches.
• Sep 10, 2026 — PaperCut ships maintenance releases 26.0.5, 25.0.13 and 24.1.10.
• Sep 14, 2026 — CISA's remediation deadline for federal agencies.
• Oct 9, 2026 — watchTowr publishes its technical analysis.

Vulnerability records

• CVE-2026-81578 · KEV 2026-08-31 · An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.
• CVE-2026-82078 · KEV 2026-08-31 · An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) papercut.com
2. CVE record — CVE-2026-81578 cve.org
3. CVE record — CVE-2026-82078 cve.org
4. NVD — CVE-2026-81578 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-81578 cisa.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-82078 cisa.gov
7. PaperCut — Behind the scenes: August security incident (Chris Dance) papercut.com
8. Huntress — PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE huntress.com
9. watchTowr Labs — Death By A Thousand PaperCuts (pre-auth RCE chain and patch bypasses) labs.watchtowr.com
10. watchTowr — PaperCut NG/MF Zero-Day: Active Exploitation Underway watchtowr.com
11. GreyNoise — AI-orchestrated campaign against PaperCut NG/MF greynoise.io
12. Rapid7 — ETR: PaperCut NG/MF critical zero-day exploited in the wild rapid7.com
13. Rapid7 Metasploit — PR #21842: PaperCut MF/NG exploit module github.com