Threat actors are actively exploiting a newly patched vulnerability in PaperCut NG and MF to run arbitrary code on vulnerable systems, prompting the company to issue a second emergency fix with extra security hardening. The attack allows someone without credentials to remotely control PaperCut's trusted settings and execute arbitrary Java code within the application's process, according to researchers John Hammond and Andrew Brandt from Huntress. The Australian firm has now publicly identified two security flaws that attackers are chaining together to breach affected systems.
PaperCut disclosed CVE-2026-82078, rated 9.4 on the CVSS severity scale, which stems from unsafe dynamic class loading in database connection utilities that instantiate driver classes based on configurable names without checking against an allowlist of approved drivers. The second flaw, CVE-2026-81578 with a score of 8.8, involves improper access control in the web management interface that lets unauthenticated remote requests targeting administrative functions trigger backend actions before access validation checks finish. Attackers are exploiting CVE-2026-81578 to bypass authentication, then editing a configuration file to exploit CVE-2026-82078 and gain remote code execution, according to Jake Knott, head of threat intelligence at watchTowr. The vulnerability in unpatched versions allows a specially crafted request to reference one page that's rendered for the response while executing a component or action owned by a different page, letting PaperCut's authorization check trust the rendered page and miss the permissions required by the component behind it.
Huntress observed limited exploitation on two customer environments, where attackers executed Base64-encoded commands on the targeted server to determine user account and operating system using the chained command "whoami & ver." The threat actors also deployed a Java .class file that works across operating systems and can run commands under Linux or Windows to fingerprint the machine and obtain a directory listing of files, writing the data to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory. Once this step completes, the .class file deletes "Udydn.out," the server's "server.log" file, and a "/data/internal/derby.log" file. In another incident recorded on August 27, 2026, the threat actors used a different version of the .class file that runs a modified command to also capture the list of running processes: "whoami & ver & tasklist." Huntress researchers explained that "at this time, we don't have enough evidence to determine the threat actors' ultimate end goal," though the activity appears consistent with early-stage reconnaissance or validation.
The flaws matter because PaperCut sits at a critical intersection—it's internet-facing, providing a pivot into corporate environments, and it stores sensitive information in the form of printed documents that can be exfiltrated. watchTowr discovered multiple patch bypasses and an additional authentication bypass vulnerability, with one of the patch bypasses remediated in the second emergency patch, though new patch bypasses affecting the latest fully patched version have been identified. Huntress also reported a bypass to the first set of emergency patches and confirmed that the second emergency patch includes security improvements that remediate parts of the attack chain. Organizations with PaperCut NG and MF in their environment should remove public exposure immediately and apply the patch as soon as possible, according to the company's guidance. It's also recommended to restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path, and begin hunting for signs of compromise such as looking for "Database error looking up cardID: VALUES CAST" errors in log files. The persistence of patch bypasses even after two emergency fixes suggests this won't be the last update defenders need to apply. For organizations managing internet-facing systems, the calculus has shifted from whether to remove public access to how quickly they can complete the isolation without disrupting operations.