PaperCut Zero-Day Under Active Attack: Two Emergency Patches in 48 Hours

If your organization runs PaperCut NG or PaperCut MF — and with 100 million users at over 70,000 organizations worldwide, there's a real chance it does — stop what you're doing and check your patch level. On August 27, 2026, PaperCut published an urgent security advisory confirming active exploitation of two previously unknown vulnerabilities in its print management software. Emergency patches followed, and then a second round of emergency patches the very next day after researchers identified bypasses in the first fix. The window between disclosure and exploitation was essentially zero: attackers were already inside customer environments when the advisory dropped.

What PaperCut Is and Why This Matters

PaperCut NG and PaperCut MF are among the most widely deployed print management platforms in the world, handling print tracking, cost control, and device management across Windows, Linux, and macOS environments. The software is especially prevalent in education, healthcare, and small-to-midsize businesses — exactly the organizations that tend to have fewer people watching their logs at 2 a.m. when an attacker runs whoami on a production server. According to the vendor, 41 percent of its customer base is small businesses. These aren't Fortune 500 shops with a SOC team; they're the kind of organizations whose print server runs quietly in a back office and never makes the vulnerability-management queue.

The Attack Chain: Two Flaws, Zero Credentials

Two CVEs are being chained together to produce unauthenticated remote code execution:

• CVE-2026-81578 (CVSS 8.8 — High): An improper access control vulnerability in PaperCut's web management interface. The flaw arises from a page-rendering mismatch: PaperCut's authorization check trusts the rendered page but fails to verify the permissions required by the back-end component actually executing the action. An unauthenticated attacker can send a specially crafted request that routes through the authorization check without tripping it, then triggers administrative functions — including configuration writes — on the server.
• CVE-2026-82078 (CVSS 9.4 — Critical): An unsafe dynamic class-loading vulnerability in PaperCut's database connection utilities. The application instantiates database driver classes based on a configurable driver name, without validating those names against any allowlist. Once an attacker has used CVE-2026-81578 to write a malicious driver reference into a configuration file, CVE-2026-82078 loads and executes arbitrary Java bytecode — giving the attacker arbitrary code execution under the PaperCut application server's service account, which in default Windows installations runs as SYSTEM.

Huntress researchers confirmed the chain works in practice, developing a proof-of-concept exploit that spawned charmap.exe processes running as SYSTEM under the PaperCut server process. The attack is fully pre-authentication.

What Attackers Are Actually Doing

Huntress observed confirmed exploitation in two customer environments. Post-exploitation activity was consistent with initial reconnaissance: hex-encoded Java .class files (named Udydn.class and Moo97.class) were deployed to the server, executing system discovery commands including whoami & ver and tasklist, writing output to files, then deleting logs and themselves to cover their tracks. The cleanup behavior suggests deliberate operational security on the attacker's part — this wasn't opportunistic noise.

A reliable forensic indicator is a suspicious log entry containing DB URL: jdbc:derby:memory:pwn alongside irregular Apache Derby database boot messages. If you're searching logs and see that string, treat it as confirmed compromise and begin incident response immediately.

The Patch Situation: Read This Carefully

PaperCut released its first emergency patch on August 27–28 for NG and MF versions 25 and 26, with version 24 patches following shortly after. If you applied that first patch and stopped there, you may not be fully protected.

On August 28, PaperCut released Emergency Patch Release 2 after researchers at watchTowr and Huntress identified multiple methods to bypass the initial fix. Release 2 includes additional hardening beyond the original patch, developed collaboratively with both firms. This is the build you need to be running right now.

Affected scope: all versions of PaperCut NG and MF prior to August 27, 2026. Patches are available for versions 24, 25, and 26 on Windows, Linux, and macOS. If you are running version 23 or earlier, no patch is available for your release — upgrade to a current supported version immediately.

Patched version numbers for PaperCut version 25: 25.0.12.76497 (NG) and 25.0.12.76496 (MF). Confirm your exact build number in the PaperCut admin interface under About before assuming you are protected.

What to Do Right Now

• Patch to Emergency Patch Release 2 immediately. Verify the exact build number, not just the version banner.
• Take PaperCut off the public internet. The application server should be accessible only from trusted internal networks or via VPN. There is no legitimate reason to expose a print management interface to the open web.
• Hunt for the compromise indicator. Search application and server logs for jdbc:derby:memory:pwn and for unexpected Derby database boot events. Also look for unknown .class files dropped to the PaperCut server directory and for charmap.exe spawned from the PaperCut process.
• Preserve evidence before patching if you find indicators. Copy server logs, configuration files, and process tree snapshots before applying patches — forensic data is overwritten quickly, and you'll want it for incident response.
• Audit service account privileges. If PaperCut runs as SYSTEM or a highly privileged domain account on your Windows systems, consider constraining that account to a dedicated low-privilege service identity as a long-term hardening measure.

The Pattern Worth Noting

PaperCut went through an almost identical situation in 2023, when CVE-2023-27350 and CVE-2023-27351 were exploited before many organizations could patch. The lesson then, as now, is that print management servers — quiet infrastructure that nobody thinks about — are exactly what attackers target for initial access. They're typically trusted on the internal network, often run with elevated privileges, and rarely appear on penetration testing scope lists. At Falcon Internet, seeing servers like this exploited is part of why our NOC monitors for anomalous process trees, not just perimeter alerts.

Apply Release 2. Check your logs. If you haven't explicitly restricted your PaperCut management interface to an internal-only network segment, do that now, before you do anything else.