---
title: "PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)"
url: https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/
description: "Unauthenticated SYSTEM RCE chain in PaperCut NG/MF; GreyNoise counted 395 victim orgs. Upgrade to 24.1.10, 25.0.13 or 26.0.5, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-08-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-81578", "CVE-2026-82078"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)

**Verdict: Act now.** If a PaperCut NG/MF server below 24.1.10, 25.0.13 or 26.0.5 was reachable from the internet after late August, assume it was compromised: upgrade, then hunt and rebuild, because this chain gave unauthenticated attackers SYSTEM and was mass-exploited.

- **Who must act:** Every organization running PaperCut NG or MF Application, Site or secondary servers below 24.1.10, 25.0.13 or 26.0.5, and anyone on version 23 or earlier, which gets no fix.
- **Who can relax:** PaperCut Hive and Pocket customers (not affected), and servers already on the maintenance releases that have been checked for compromise; Mobility Print, Print Deploy and the client software need no update.
- **Affected:** PaperCut NG/MF before 24.1.10; PaperCut NG/MF 25.0.0 before 25.0.13; PaperCut NG/MF 26.0.0 before 26.0.5; PaperCut NG/MF 23 and earlier (no patch; upgrade to 24, 25 or 26); Emergency Patch Releases 1 and 2 (bypassable)
- **Fixed:** PaperCut NG/MF 26.0.5; PaperCut NG/MF 25.0.13; PaperCut NG/MF 24.1.10; Emergency Patch Release 3 (Sep 1, 2026) also protects; move to a maintenance release
- **CVEs:** CVE-2026-81578, CVE-2026-82078
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade every PaperCut NG/MF Application Server, Site Server and secondary server to 26.0.5, 25.0.13 or 24.1.10, and schedule the move off version 23 or earlier now.
2. Restrict the Application Server's web interfaces to trusted internal addresses and remove any internet exposure.
3. On any server that was exposed while unpatched, capture a JVM heap or memory dump and copy the logs before restarting, because in-memory web shells vanish on restart.
4. Check the external user-lookup settings (user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql) for values you did not set.
5. If you find indicators, rebuild the Application Server from a clean pre-incident backup and reset domain credentials the server could reach.
6. Patch Active Directory against noPac (CVE-2021-42278/42287) if you have not, since attackers used it to reach domain admin after PaperCut.

### How to check if you are affected

- Search server.log for 'No suitable driver found for jdbc:no:x', 'jdbc:derby:memory:pwn' or 'looking up cardID: VALUES CAST', and treat a missing or truncated server.log as suspicious.
- Look for pc-app.exe (or pc-app) spawning cmd.exe or PowerShell, such as 'whoami & ver', tasklist or nltest /dclist:, and for 5-character .class files in server\lib with .cmd/.out files in server\data\content.
- Search web logs for /app?service=direct/... requests chaining LogonMessage with ConfigEditor, UserList or SetupAdmin, and POST bodies setting org.h2.Driver or jdbc:h2:mem:.
- Check for a 'Remote Access Service' (SimpleHelp) service, unexpected AnyDesk, an Administrator17 account, C:\ProgramData\ligolo-agent.exe, or traffic to 45.142.193.132, 45.158.196.75, 103.124.105.161 or 107.180.182.122.

## What happened

On August 27, 2026, PaperCut published an [urgent bulletin](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/) about active exploitation of PaperCut NG and MF. According to [CEO Chris Dance](https://www.papercut.com/blog/news/behind-the-scenes-august-security-incident/), an education customer reported a compromised MF server that morning. [Huntress](https://www.huntress.com/blog/papercut-actively-exploited) had already seen exploitation in a customer environment on August 26. PaperCut then disclosed two chained bugs:

- [CVE-2026-81578](https://www.cve.org/CVERecord?id=CVE-2026-81578) (CWE-306, vendor CVSS 4.0 8.8; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-81578) CVSS 3.1 9.8). Unauthenticated requests to admin functions "can trigger backend actions prior to the completion of access validation checks." This lets an attacker change system configuration.
- [CVE-2026-82078](https://www.cve.org/CVERecord?id=CVE-2026-82078) (CWE-470, CVSS 4.0 9.4). The database connection code loads driver classes by configurable name without an allowlist. Once the configuration is changed, this lets an attacker run arbitrary Java bytecode as the PaperCut server process.

[watchTowr](https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/) traced the bypass to page handling. The authorization check ran only for the first page named in a request, such as the unauthenticated `LogonMessage`, so an admin form nested after it, such as `ConfigEditor`, was reachable without logging in. [Rapid7](https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/) says the attacker rewrites the external user-lookup settings, points them at a malicious JDBC URL, and then triggers a lookup. Huntress's proof of concept ran code as SYSTEM under `pc-app.exe`.

The first emergency patch (Aug 28) could be bypassed. PaperCut followed with Release 2 the same day, Release 3 on September 1, and maintenance releases 26.0.5, 25.0.13 and 24.1.10 on September 10. A [Metasploit module](https://github.com/rapid7/metasploit-framework/pull/21842) was merged on September 3. CISA added both CVEs to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578) on August 31, with a [due date](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078) of September 14. watchTowr later found a third bug, CVE-2026-82077, a post-authentication RCE through Scan to Fax. It is fixed in 26.0.5 and not known to be exploited.

Exploitation was broad. [GreyNoise](https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf) tracked a likely Russian-speaking actor that "used OpenAI's Codex with a DeepSeek model" to diff the patch and build tooling. The actor's first remote code execution against a real target came on August 31, and the full campaign launched on September 1. GreyNoise counted "at least 440 instances" at 395 organizations in 48 countries, with domain admin reached at 12 of them, in part through noPac where AD was unpatched. [watchTowr](https://watchtowr.com/intelligence/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/) saw in-memory Godzilla web shells installed as servlet filters on August 31, and more than 1,000 exploit attempts against its sensors.

## Who is affected

PaperCut says all versions of NG and MF are affected, including Site Servers and secondary servers. Versions 23 and earlier get no patch. Huntress says about 47% of the roughly 2,500 PaperCut installations it tracks run v23 or older. Hive, Pocket, Mobility Print, Print Deploy and the client software are not affected. GreyNoise notes that PaperCut servers run as SYSTEM on Windows by default and are usually domain-joined.

## Do you really need to act?

Yes. The chain needs no credentials, a public exploit exists, and attackers hit hundreds of organizations within days. PaperCut says unpatched servers that remain publicly reachable "continue to be targeted." Patching does not remove an existing in-memory shell, a dropped remote-access tool or harvested domain credentials. If your server faced the internet before you installed Release 3 or a maintenance release, treat it as compromised until you have checked. Internal-only servers are lower risk, but still upgrade them now.

## What to do now

1. Upgrade the Application Server, then every Site Server and secondary server, to 26.0.5, 25.0.13 or 24.1.10. If you are on version 23 or earlier, upgrade to a supported line.
2. Firewall the Application Server's web interfaces so only trusted internal addresses can reach them.
3. Before restarting an exposed server, capture a JVM memory dump (for example `jcmd <pid> GC.heap_dump <file>` where a JDK is available) and copy the logs.
4. Review the external user-lookup settings for values you did not set. If you really use external card-number lookups, apply the `server/security.properties` change PaperCut documents; otherwise leave the feature off.
5. If anything looks wrong, follow PaperCut's guidance to rebuild from a clean pre-incident backup and start incident response, including resetting domain credentials the server could reach.

## How to tell if you were hit

On Windows, run `findstr /S /C:"jdbc:no:x" /C:"jdbc:derby:memory:pwn" /C:"VALUES CAST" "<install>\server\server.log*"`, or use `grep -rE` on Linux. A missing or truncated `server.log` is itself a warning sign. Look for `pc-app.exe` spawning `cmd.exe`, 5-character `.class` files in `server\lib`, and a service running `SimpleService.exe` (`Get-CimInstance Win32_Service | ? PathName -like '*SimpleService*'`). Search web logs for `LogonMessage/ConfigEditor` or `Home/SetupAdmin` in the `service=` parameter, and for `org.h2.Driver` in POST bodies. Then check the IPs, files and the `Administrator17` account listed in the detection panel.

## Timeline

- Aug 26, 2026 — Huntress observes exploitation in a customer environment.
- Aug 27, 2026 — A customer reports a compromise, and PaperCut publishes its bulletin.
- Aug 28, 2026 — Emergency Patch 1, a bypass of it, and Release 2. The CVEs are published.
- Aug 31, 2026 — CISA adds both CVEs to KEV. GreyNoise and watchTowr observe successful exploitation.
- Sep 1, 2026 — PaperCut ships Release 3, and the mass campaign launches.
- Sep 10, 2026 — PaperCut ships maintenance releases 26.0.5, 25.0.13 and 24.1.10.
- Sep 14, 2026 — CISA's remediation deadline for federal agencies.
- Oct 9, 2026 — watchTowr publishes its technical analysis.

## Sources

1. [PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)
2. [CVE record — CVE-2026-81578](https://www.cve.org/CVERecord?id=CVE-2026-81578)
3. [CVE record — CVE-2026-82078](https://www.cve.org/CVERecord?id=CVE-2026-82078)
4. [NVD — CVE-2026-81578](https://nvd.nist.gov/vuln/detail/CVE-2026-81578)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-81578](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-82078](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078)
7. [PaperCut — Behind the scenes: August security incident (Chris Dance)](https://www.papercut.com/blog/news/behind-the-scenes-august-security-incident/)
8. [Huntress — PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE](https://www.huntress.com/blog/papercut-actively-exploited)
9. [watchTowr Labs — Death By A Thousand PaperCuts (pre-auth RCE chain and patch bypasses)](https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/)
10. [watchTowr — PaperCut NG/MF Zero-Day: Active Exploitation Underway](https://watchtowr.com/intelligence/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/)
11. [GreyNoise — AI-orchestrated campaign against PaperCut NG/MF](https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf)
12. [Rapid7 — ETR: PaperCut NG/MF critical zero-day exploited in the wild](https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/)
13. [Rapid7 Metasploit — PR #21842: PaperCut MF/NG exploit module](https://github.com/rapid7/metasploit-framework/pull/21842)

---
Source page: https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt