PaperCut CVE-2026-82078: Second Emergency Patch After Attackers Broke the First Fix

PaperCut shipped a second emergency patch within roughly 48 hours of the first one. That timing tells administrators something on its own: the original fix for PaperCut CVE-2026-82078 didn’t fully close the hole attackers were using.

PaperCut NG and PaperCut MF now carry two disclosed vulnerabilities, CVE-2026-82078 and CVE-2026-81578. Chained together, they let an unauthenticated attacker reach the PaperCut Application Server, alter its configuration, and run code under the server’s own security context, without needing credentials. Huntress reproduced the full chain and confirmed exploitation in two customer environments, while watchTowr’s analysis helped identify patch bypasses and an additional authentication-bypass issue.

This matters beyond the CVE score. PaperCut sits inside networks that touch identity systems, file shares, and endpoint fleets across universities, hospitals, and enterprises. A print management server with pre-authentication RCE isn’t a maintenance item; it’s an active exposure that needs immediate patching, log review, and endpoint investigation.

Two flaws, one pre-authentication path to code execution

Two flaws combine into a single pre-auth exploit chain:

• CVE-2026-81578 (CVSS 8.8): A permissions-checking flaw. PaperCut validates access for the page it returns, not the action a request actually triggers. Unauthenticated requests can reach administrative functions before validation completes, letting an attacker change server configuration without logging in.
• CVE-2026-82078 (CVSS 9.4, Critical): PaperCut’s database connection utilities load driver classes from configuration values with no allowlist check. An attacker who can manipulate those configuration values can execute arbitrary Java bytecode residing on the PaperCut application classpath under the PaperCut server process’s security context.
• Chained result: An unauthenticated attacker can bypass login, alter configuration, and execute code under the PaperCut server process’s own security context.
• Confirmed in testing: Huntress reproduced the chain on a stock PaperCut NG build and triggered the server process into launching a system utility with SYSTEM privileges, confirming code execution at the highest Windows privilege tier.

From reconnaissance to remote access tools

Huntress tracked exploitation in two customer environments:

• Incident 1: A Java class file was decoded and ran on the server, executing basic identification commands (user and OS version). The attacker then deleted the output file and the PaperCut server log to erase evidence.
• Incident 2: Same pattern, with an added command to list running processes.

That was reconnaissance. PaperCut’s latest update reports the next step: attackers are now covertly installing legitimate remote access software on compromised Application Servers. Ransomware deployment, data theft, and lateral movement beyond the PaperCut host remain unconfirmed, but the move from information-gathering to persistent remote access is a real escalation and should be treated as an active-intrusion signal, not routine noise.

PaperCut has drawn this kind of attention before. A 2023 vulnerability in the same platform was linked to multiple ransomware-affiliated groups. That doesn’t predict where this campaign goes, but it explains why PaperCut keeps getting targeted.

Signals that warrant immediate investigation

PaperCut has been explicit that the absence of these signals doesn’t rule out compromise, particularly since attackers have shown they can delete the very logs a team would check.

Why the first patch wasn’t enough

• PaperCut shipped Emergency Patch Release 1 for NG/MF versions 24–26.
• Within about two days, watchTowr found multiple bypasses plus a second authentication issue, forcing Release 2 with additional hardening.
• PaperCut recommends installing Release 2 even if Release 1 is already applied — Release 1 isn’t redundant; it’s incomplete.
• Separately, a large share of tracked PaperCut deployments still run version 23 or earlier, which has no available patch, leaving exposed servers regardless of how fast current customers move.

Featured resource

Introduction to Hexnode XDR

Hexnode XDR unifies threat detection, endpoint correlation, and UEM integration for proactive, coordinated enterprise defense.

DOWNLOAD

Where Hexnode fits into PaperCut incident response

Hexnode UEM and Hexnode XDR don’t replace patching PaperCut itself — they support the surrounding response work.

UEM (before and during patching):

• Write and deploy a custom script through Hexnode UEM’s script deployment feature to check installed PaperCut versions across the Windows fleet and flag machines still awaiting Release 2.
• Use Hexnode UEM’s automated patch management to build criteria-based policies that deploy critical OS security updates without manual intervention, shrinking the standing attack surface around servers like PaperCut’s.

XDR (if the PaperCut host is already a managed endpoint):

• Isolate a suspected device from the network while keeping a live connection to the XDR console for forensics.
• Kill a malicious process or its entire process tree.
• Quarantine suspicious binaries recovered from the server.

None of this replaces applying Emergency Patch Release 2, restricting the Application Server to trusted IPs, or engaging PaperCut and incident response specialists directly. Telemetry and containment work alongside those steps, not instead of them.

Conclusion

The PaperCut patch cycle shows how quickly a “patched” vulnerability can turn out not to be. Enterprises running PaperCut NG or MF should install Emergency Patch Release 2 regardless of prior patch status, restrict application-server access to trusted networks, and review server logs for the specific indicators PaperCut has published, treating log gaps as suspicious rather than reassuring.

Beyond this incident, the lesson holds for any internet-facing management platform: patch confirmation, log integrity, and endpoint visibility all need to move together, not in sequence.