U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2026-81578 (CVSS score of 8.8) PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- CVE-2026-82078 (CVSS score of 9.4) PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut, the print management software running in schools, hospitals, and offices worldwide, recently confirmed that a pre-authentication remote code execution flaw, tracked as CVE-2026-81578, is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.
“Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress.
“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.”
The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page.
PaperCut checks the permissions for the page it displays instead of the action it actually performs. The flaw CVE-2026-81578 can let an attacker change the server’s configuration without logging in.
That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.
The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.
The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse.
The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.
“After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb”
PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.
The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available.
Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaws by September 14.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
