PaperCut NG/MF, the print-management platform deployed across universities, hospitals, and government print fleets, is under active attack. Two vulnerabilities — CVE-2026-81578 (auth bypass, CVSS 8.8) and CVE-2026-82078 (unsafe class loading, CVSS 9.4) — chain into unauthenticated remote code execution on the Application Server.
Huntress observed the first exploitation attempts on August 26, 2026. After watchTowr found multiple bypasses of the original fix, PaperCut shipped a second emergency patch the same day, extending hardening back to version 24. If your PaperCut server is internet-facing, treat it as a priority-one exposure.
◈ Table of Contents
Background & Affected Products
Phase 01PaperCut NG/MF centralizes print quotas, secure release, and cost recovery. The Application Server exposes a web management interface that, in many deployments, is reachable from the wider network or the internet. Two independently reported flaws combine to give a remote, unauthenticated attacker code execution inside the server's Java process.
| CVE | Type | CVSS | Severity |
|---|---|---|---|
| CVE-2026-81578 | Improper access control (auth bypass) in web management interface | 8.8 | HIGH |
| CVE-2026-82078 | Unsafe dynamic class loading in database connection utilities | 9.4 | CRITICAL |
| Product | Affected | Fixed / Patched |
|---|---|---|
| PaperCut NG | Versions through v24, v25, v26 | Second emergency patch for v24, v25, v26 |
| PaperCut MF | Versions through v24, v25, v26 | Second emergency patch for v24, v25, v26 |
Both NG and MF share the affected Application Server code. A single unpatched, internet-facing server is enough for full compromise — no credentials required.
Exploitation & Attack Chain
Phase 02The chain is elegant and brutal. Per watchTowr's Jake Knott, CVE-2026-81578 lets an attacker reach administrative functions before access validation finishes; that access is used to edit a configuration file, which then triggers the unsafe class loading of CVE-2026-82078. The application loads an attacker-named database driver class — arbitrary Java executes inside the server process.
Huntress reported limited but concrete hands-on-keyboard activity across two customer environments, focused on system discovery and remote-access tooling.
- 1Base64-encoded reconnaissance commands executed for host fingerprinting.
- 2Discovery via
whoami & verandwhoami & ver & tasklist. - 3OS-agnostic Java
.classfile used for directory enumeration. - 4Persistence via AnyDesk install and SimpleHelp executed as a Windows service.
- 5Log-file deletion to cover tracks after actions-on-objectives.
The reconnaissance runs inside the PaperCut Java process, so command execution inherits the service account. On Windows that is frequently a high-privilege local account — scope containment accordingly.
Indicators of Compromise
Phase 03These indicators come from Huntress and watchTowr telemetry. The server.log strings are the most reliable early tell — the exploit leaves a distinctive JDBC/Derby footprint and a CAST cardID error.
| Type | Indicator |
|---|---|
| Log string | DB URL: jdbc:derby:memory:pwn;create=true |
| Log string | Database error looking up cardID: VALUES CAST(X'cafebabe |
| Log string | DB URL: jdbc:no:x DB Driver: <5-char random name> |
| File | <install>\server\lib\<5-char-name>.class |
| File | <install>\server\data\content\<5-char-name>.cmd |
| File | <install>\server\data\content\<5-char-name>.out |
| File | Udydn.out (observed exfil file) |
| Path | C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\ |
| Path | C:\ProgramData\AnyDesk.exe |
Detection & Hunt Queries
Phase 04Hunt in two places: the PaperCut host's own logs for the exploit footprint, and endpoint process telemetry for the reconnaissance and remote-access tooling spawned by the Java process.
The final stage deletes logs. If the PaperCut server.log has gaps or was recently truncated, treat that as an indicator rather than an all-clear.
Mitigation & Patching
Phase 05- 1Apply the second emergency patch for PaperCut NG/MF v24, v25, or v26 — the first patch is bypassable per watchTowr.
- 2Remove internet exposure. The Application Server web interface should never be directly reachable from the internet.
- 3Restrict access to the management interface to trusted IP ranges, or place it behind a VPN / controlled admin path.
- 4Hunt before you trust. Search
server.logfor the CAST/Derby strings and review for the.class/.cmd/.outartifacts. - 5Rotate credentials and review the PaperCut service account if any indicator is present.
- Version banner shows the second emergency patch build for your track (v24/v25/v26)
- Management interface returns access-denied to unauthenticated admin-function requests
- No unknown 5-character .class files under server\lib
- No AnyDesk or SimpleHelp artifacts on the print server
MITRE ATT&CK Mapping
Phase 06| Tactic | Technique | Observed behaviour |
|---|---|---|
| Initial Access | T1190 — Exploit Public-Facing Application | Auth bypass + class loading against internet-facing PaperCut |
| Execution | T1059 — Command & Scripting Interpreter | Base64 cmd, Java .class execution |
| Discovery | T1082 / T1057 — System Info & Process Discovery | whoami, ver, tasklist |
| Persistence / C2 | T1219 — Remote Access Software | AnyDesk, SimpleHelp |
| Defense Evasion | T1070.001 — Clear Windows Event/Log Files | Log deletion after actions |
Sources & References
Phase 07Is your print infrastructure exposed?
Run any suspect PaperCut IOC — the JDBC strings, AnyDesk paths, or 5-character .class artifacts — through the CyberHawk IOC Scanner, and track active-exploitation advisories on the CyberHawk Threat Intel feed.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."