PaperCut Releases Second Emergency Patch After Attackers Bypass Initial Fixes

PaperCut has released a second emergency security patch for two critical vulnerabilities in its PaperCut NG and PaperCut MF print management software after security researchers discovered multiple methods to bypass the original emergency fixes. The vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578, can be chained together to allow unauthenticated remote code execution on vulnerable servers. Huntress, a cybersecurity firm assisting in the investigation, confirmed it observed active exploitation in customer environments and successfully reproduced the full pre-authentication attack chain. Organizations running PaperCut NG or MF versions 24, 25, or 26 on Windows, Linux, or macOS should install Emergency Patch Release 2 immediately, regardless of whether the first emergency patch was applied.

What Happened: PaperCut Issues Second Emergency Patch After Attackers Bypass Initial Fixes

PaperCut first warned customers on August 28, 2026, that hackers were actively exploiting a vulnerability in zero-day attacks against PaperCut NG and MF servers. The company released an initial emergency patch for versions 25 and 26 but withheld CVE identifiers and technical details while investigating the scope of the attacks.

Following further analysis conducted jointly with researchers at Huntress and watchTower, PaperCut published full technical details and released Emergency Patch Release 2 on August 29, 2026. The second patch includes additional hardening developed after watchTower researchers fully reproduced both vulnerabilities, discovered multiple patch bypasses in the original fix, and identified an additional authentication bypass vulnerability that had not been addressed.

Huntress confirmed it observed exploitation occurring in two customer environments and reproduced the complete pre-authentication remote code execution chain. The attacks appear to have been limited and targeted rather than opportunistic. PaperCut has not publicly identified the threat actors behind the campaign but noted the investigation remains active.

Technical Details of the PaperCut Vulnerabilities

The two PaperCut vulnerabilities can be exploited in combination to achieve pre-authentication remote code execution on vulnerable servers.

CVE-2026-81578: Authentication Bypass (CVSS 8.8)

The first vulnerability is a high-severity authentication bypass affecting the PaperCut NG and MF web management interface. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an attacker to reach privileged operations without providing valid credentials.

CVE-2026-82078: Unsafe Class Loading (CVSS 9.4)

The second vulnerability is a critical unsafe dynamic class-loading flaw in PaperCut’s database connection utilities. The application loads database driver classes based on configurable driver names without validating them against an approved allowlist. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

When chained together, these vulnerabilities allow an unauthenticated remote attacker to bypass authentication mechanisms, manipulate database driver configuration, and execute arbitrary Java code on the underlying server. The watchTower research team demonstrated that this chain could be executed reliably against unpatched systems.

Observed Post-Exploitation Activity

Huntress examined forensic evidence from compromised PaperCut servers and identified attacker commands consistent with system reconnaissance. Hex-encoded Java class files found in server logs acted as a bridge between the PaperCut application and the operating system, allowing attackers to execute commands and read or write files. The commands observed appeared focused on internal reconnaissance rather than malware deployment or persistent backdoor installation, though the investigation is ongoing.

Administrators should also watch for the following indicators of compromise: the pc-app.exe process exhibiting suspicious behavior, missing or truncated server.log files, and these specific error messages in server.log: ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.

Business and Operational Impact

The PaperCut print management software is widely deployed across enterprises, educational institutions, healthcare organizations, and government agencies. A successful exploit grants remote code execution at the privilege level of the PaperCut server process, which in many deployments runs with high system privileges.

• Exposure scope: Emergency Patch Release 2 applies to PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS. Version 23 and earlier are no longer supported and should be upgraded to the latest release.
• Site servers affected: PaperCut advises that Site Servers and secondary or print servers should also be upgraded to patched versions, not just the primary application server.
• Scope of post-exploitation: Huntress confirmed the attackers used the compromised servers for internal reconnaissance. A successful RCE foothold could be leveraged for lateral movement, data theft, or follow-on attacks depending on the attacker’s objectives.
• Patch bypass risk: The discovery that the original emergency patch could be bypassed means organizations who applied only the first patch remain vulnerable. Release 2 must be applied to close the identified bypass paths.
• Service continuity: PaperCut warned customers they may experience intermittent service degradation related to the attack, though the company is not proactively disconnecting systems.

Mitigation and Recommendations

Organizations running PaperCut NG or MF should take the following actions immediately.

Immediate Patching

1. Download and install Emergency Patch Release 2 from the PaperCut security bulletin. This applies to versions 24, 25, and 26 on all supported platforms.
2. Patch all Site Servers and secondary print servers, not only the primary application server.
3. If running version 23 or earlier, upgrade directly to the latest version rather than waiting for a patch for end-of-life releases.

Network-Level Restrictions

1. Restrict access to the PaperCut web management interface to trusted IP addresses using firewall rules, network access controls, or equivalent measures. PaperCut explicitly recommends this even for patched systems.
2. Review outbound connections from PaperCut servers for any suspicious C2 or exfiltration activity.

Forensics and Detection

1. Review server.log files for the error messages ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.
2. Examine logs for missing or truncated server.log files, which may indicate attacker tampering.
3. Monitor the pc-app.exe process for suspicious child process creation or anomalous network behavior.
4. Check for unexpected hex-encoded Java class files in temporary directories or PaperCut working directories.

Bottom line: Apply Emergency Patch Release 2 to all PaperCut NG and MF servers immediately, restrict web interface access to trusted IPs, and search server logs for indicators of compromise. Assume that any unpatched server has been compromised if it was exposed to the internet.

Incident Summary

CVE IDs:	CVE-2026-82078 (CVSS 9.4) and CVE-2026-81578 (CVSS 8.8)
Affected Systems:	PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS; Site Servers and secondary print servers also affected
Disclosure Date:	August 28, 2026 (initial advisory); August 29, 2026 (full technical disclosure and Release 2 patch)
Patch Status:	Emergency Patch Release 2 available for versions 24, 25, and 26; versions 23 and earlier require upgrade to latest version
Active Exploitation:	Confirmed by Huntress in at least two customer environments

References

1. PaperCut, “Security Bulletin: Urgent Security Advisory,” August 27, 2026, https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
2. BleepingComputer, “PaperCut releases second emergency patch for exploited flaws,” August 29, 2026, https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/
3. Huntress, “PaperCut Actively Exploited,” August 2026, https://www.huntress.com/blog/papercut-actively-exploited
4. watchTower (LinkedIn), post on PaperCut vulnerability research, August 2026, https://www.linkedin.com/posts/yesterday-watchTowr-rapidly-reacted-to-share-7499107361605722112-b2gE/