PaperCut's second emergency patch chains two exploited flaws
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software. The Emergency Patch Release 2 arrived just days after researchers uncovered multiple bypasses for the initial fix, and it chains together hardening for CVE-2026-81578 and CVE-2026-82078, both of which have been weaponized in targeted attacks against customer servers.
CVE-2026-81578: Authentication bypass on the web management interface
CVE-2026-81578 carries a CVSS score of 8.8 and is described by PaperCut as an authentication bypass vulnerability. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. The flaw exists in the PaperCut NG/MF web management interface and allows attackers without credentials to force the server to execute administrative actions before validation finishes. PaperCut's updated advisory explains that the issue arises when requests are crafted to overlap the validation window, creating a brief but actionable gap.
CVE-2026-82078: Unsafe dynamic class-loading in database utilities
The second flaw, CVE-2026-82078, is rated 9.4 CVSS and stems from PaperCut's database connection utilities. The application loads database driver classes based on configurable driver names without validating them against an approved allowlist. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. In practical terms, an attacker who can influence configuration can inject and run malicious Java code on the server.
Emergency Patch Release 2 deployed
On Friday, PaperCut released Emergency Patch Release 2, an updated security fix that includes additional hardening developed after further analysis with its internal security team and researchers at Huntress and watchTowr. The company is urging all customers to install Release 2 even if they already installed the first emergency patch. This second release came after watchTowr reported that its researchers fully reproduced the vulnerabilities, discovered multiple patch bypasses, and identified an additional authentication bypass vulnerability.
Huntress, which has been working with PaperCut during the incident, says it observed exploitation in two customer environments and reproduced the full pre-authentication RCE chain. The company told BleepingComputer that PaperCut logs captured commands used by the attackers for system reconnaissance, while hex-encoded Java .class files found in the logs acted as an RCE bridge between PaperCut and the underlying operating system, allowing commands to be executed and files to be read or written. The commands observed by Huntress appear to have been used for reconnaissance rather than to deploy malware or establish persistence. Huntress also says it discovered multiple bypasses for the original emergency patches and an additional authentication bypass vulnerability, which it shared with PaperCut.
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS. Customers running version 23 or earlier are advised to upgrade to the latest version rather than wait for a patch for those releases. PaperCut says Site Servers and secondary/print servers should also be upgraded to patched versions. Other components like Print Deploy and Mobility Print are not affected and do not require updates.
Even though patches are available, PaperCut urges customers to restrict access to the web interfaces to trusted IP addresses using firewall rules, network access controls, or equivalent measures. Administrators should also look for suspicious post-exploitation activity from the pc-app.exe process, missing or truncated server.log files, and specific errors: ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.
Historical context from 2023 attacks
PaperCut servers were previously targeted in 2023 after attackers began exploiting CVE-2023-27350, an authentication bypass and remote code execution vulnerability. Those attacks were ultimately linked to numerous threat actors, including the Clop and LockBit ransomware operations, Iranian state-backed hacking groups, and the Bl00dy Ransomware Gang. Cybersecurity firm watchTowr worked with PaperCut during the current incident, and Huntress reproduced the full exploit chain. The earlier 2023 exploitation demonstrates that PaperCut vulnerabilities have long been in threat actors' crosshairs, particularly for ransomware operators seeking initial access.
What PaperCut is not saying
PaperCut told BleepingComputer that the attacks appear limited and targeted, and that it is withholding details about post-exploitation activity. ""Our investigation into what attackers are doing post-compromise is still active, and premature detail could complicate any affected customers' own response," PaperCut told BleepingComputer. "What we can say: the bulletin advises customers to watch for intrusion-detection, endpoint, or network-monitoring alerts tied to the PaperCut Application Server, and we'll publish indicators of compromise as they're verified.""
Conclusion
PaperCut's second emergency patch represents a significant step toward closing two actively exploited security gaps. The chain of fixes for CVE-2026-81578 and CVE-2026-82078 addresses both an authentication bypass and a dangerous class-loading flaw that together allow unauthenticated remote code execution. However, the company remains tight-lipped about what happens after initial compromise, and the full scope of post-exploitation activity remains under investigation. In the meantime, customers should prioritize upgrading to Emergency Patch Release 2, restrict web interface access, and monitor server logs for the specific error signatures PaperCut has outlined.
