PaperCut shipped a second emergency patch within roughly 48 hours of the first one. That timing tells administrators something on its own: the original fix for PaperCut CVE-2026-82078 didn’t fully close the hole attackers were using.<\/p>\n
PaperCut NG and PaperCut MF now carry two disclosed vulnerabilities, CVE-2026-82078 and CVE-2026-81578<\/a>. Chained together, they let an unauthenticated attacker reach the PaperCut Application Server, alter its configuration, and run code under the server’s own security context, without needing credentials. Huntress reproduced the full chain and confirmed exploitation in two customer environments, while watchTowr\u2019s analysis helped identify patch bypasses and an additional authentication-bypass issue.<\/p>\n This matters beyond the CVE<\/a> score. PaperCut sits inside networks that touch identity systems, file shares, and endpoint fleets across universities, hospitals, and enterprises. A print management server with pre-authentication RCE<\/a> isn’t a maintenance item; it’s an active exposure that needs immediate patching, log review, and endpoint investigation.<\/p>\n