CVE-2026-81578 Explained: PaperCut NG/MF Missing Authentication Flaw Chained for Pre-Auth RCE

PaperCut NG and PaperCut MF sit in a structurally sensitive position on most networks that run them: the Application Server typically has broad reach into Active Directory or another identity store for user lookups, holds print job data that can include sensitive document metadata, and in many deployments is reachable from a wide swath of the internal network so that print clients across an organization can reach it. A vulnerability that hands an unauthenticated attacker a foothold on that server is not a narrow print-queue nuisance; it is a foothold on infrastructure with identity and file-handling access.

According to reporting cited by The Hacker News, watchTowr's head of threat intelligence Jake Knott summarized the chain directly: CVE-2026-81578 allows an attacker to bypass authentication, and from there the attacker can edit a configuration file to trigger CVE-2026-82078 and achieve remote code execution. Both CVEs were exploited as zero-days, meaning attackers had working exploitation before PaperCut had a patch available, which is a meaningfully higher-risk starting position than a vulnerability disclosed alongside its fix.

Treat any internet-facing PaperCut Application Server as a priority-one asset until you have confirmed both its exposure and its patch level. Organizations that also patch based on an established patch management program will find this a useful test case for how quickly an emergency, pre-patch-available disclosure can move through their existing process.

CVE-2026-81578 and CVE-2026-82078 affect PaperCut NG and PaperCut MF running on Windows, Linux, and macOS. PaperCut's updated guidance also clarifies that the fix needs to reach every server role in a deployment, not only the primary Application Server: site servers and secondary or backup print servers must be patched as well, since a deployment that patches only its primary server while leaving a site server on a vulnerable build has not actually closed the exposure.

PaperCut's patch rollout happened in two stages within about 48 hours of each other. The first emergency patch, released August 28, 2026, covered version branches 25 and 26. Researchers then found that fix could be bypassed, and PaperCut shipped a second emergency patch the same day that expanded coverage to include version 24 and added further hardening to the fix for 25 and 26. Customers running PaperCut NG/MF version 23 or earlier have no patch available for their branch at all; PaperCut's guidance for those environments is to upgrade to a supported, patched version rather than wait.

Subsequent PaperCut guidance, referenced in BleepingComputer's follow-up coverage, goes further still for internet-facing deployments: PaperCut recommends that customers with internet-facing Application Servers install the latest available release rather than stopping at the second emergency patch. If your PaperCut instance is reachable from the public internet, do not treat "patched to Emergency Patch Release 2" as the finish line without checking whether a newer release has since superseded it.

Exploitation of this chain is confirmed, not theoretical. PaperCut's own bulletin describes attacks against customer environments beginning before a fix existed, and CISA's addition of both CVEs to the KEV catalog on August 31, 2026, reflects CISA's own confirmed-exploitation standard rather than a severity score alone. That gives this threat two separate, corroborating CISA data points: the KEV catalog listing itself and CISA's dedicated alert announcing the addition, published the same day.

What has not been established publicly is who is behind the activity. According to BleepingComputer's reporting, PaperCut "has yet to attribute the attacks or explain what the threat actors are doing after compromising vulnerable servers." No named ransomware operation, intrusion set, or nation-state actor has been publicly tied to exploitation of CVE-2026-81578 or CVE-2026-82078 as of this writing.

Observed post-exploitation behavior is also narrower than a full remote-code-execution outcome might suggest. Threat intelligence firm Defused, cited in the same BleepingComputer reporting, described attackers abusing the authentication bypass to hijack PaperCut's external user-lookup functionality and dump database tables via the embedded Apache Derby database, consistent with data theft rather than the full RCE chain being used to deploy additional tooling in every observed case. That is a materially different pattern from PaperCut's last major exploitation wave: CISA and Microsoft documented CVE-2023-27350, a separate PaperCut NG/MF remote-code-execution vulnerability, being exploited by affiliates of the LockBit and Bl00dy ransomware operations in 2023 to deploy ransomware payloads directly. The current campaign, based on what has been reported so far, looks more like targeted reconnaissance and data theft than a repeat of that mass-ransomware pattern, though that assessment could change as more incidents come to light.

No public proof-of-concept exploit or full technical write-up of the exact request sequence has been released for this chain, so detection guidance at this stage is necessarily based on the behavior categories described by researchers and PaperCut rather than a single signature. This site's platform provides Sigma-matched and generic detection guidance for this threat class; treat it as a starting hypothesis set to tune against your own environment rather than a vendor-verified, PaperCut-specific detection rule, since no vendor-authored detection content specific to these two CVEs has been independently verified as of this writing.

Prioritize the following review areas:

• PaperCut Application Server web access logs for requests to administrative or configuration-related endpoints that originate without an established, authenticated session, particularly from source IP addresses outside your expected administrator ranges.
• Configuration change activity on the Application Server, site servers, and any secondary print servers, focused on database connection settings or driver configuration values changed outside a documented maintenance window.
• Apache Derby database access patterns, since reported exploitation includes bulk table dumps from PaperCut's embedded Derby database rather than only server-side code execution.
• External user-lookup activity against your identity provider or directory service initiated by the PaperCut Application Server, watching for lookup volume or patterns inconsistent with normal print-job authentication.
• Process creation and outbound network activity on the Application Server host itself, since a successful chain to CVE-2026-82078 results in the server process executing attacker-supplied code, which can spawn unexpected child processes or open unexpected outbound connections.

If you are building a repeatable hunt around this chain rather than a one-time log sweep, our guide to building a patch management program from scratch covers how to structure ongoing detection and validation work around a specific vendor advisory like PaperCut's, which is useful given that this fix has already changed twice.

Before deciding whether this is a routine patch cycle or an active incident for your organization, work through the following checks in order. Because the fix itself changed twice within days of disclosure, confirming your current build number is more important here than it usually is for a single-patch vulnerability.

Patching is the only complete fix for this chain, but because the patch itself has already been revised twice, remediation here is a two-part job: applying a current fix, and confirming it is actually the current fix rather than an already-superseded one.

The most consequential gap here is that the fix itself is a moving target. PaperCut shipped an emergency patch, confirmed within about 48 hours that it could be bypassed, shipped a second emergency patch, and has since recommended that internet-facing customers move beyond that second patch to whatever release is current. A "we already patched this" answer from your team is only as good as the date it was checked. Next step: recheck your build number against PaperCut's security bulletin directly before closing this out, rather than relying on a patch confirmation from earlier in the disclosure window.

Attribution remains unconfirmed. No named ransomware operation, threat group, or nation-state actor has been publicly tied to exploitation of CVE-2026-81578 or CVE-2026-82078 as of this writing, and PaperCut itself has stated it has not yet attributed the attacks. Next step: watch CISA's KEV catalog entry and PaperCut's own bulletin for updates, and treat any attribution claim you encounter elsewhere with skepticism until a named vendor, CISA, or an incident response firm confirms it directly.

There is no full public technical write-up of the exact exploitation chain. Researchers have described the concept, an authentication bypass used to alter configuration that then triggers unsafe class loading, but the precise request sequence has not been published, and this article will not attempt to reconstruct it. Next step: rely on PaperCut's own advisory and the detection categories above rather than assuming a specific published signature exists.

Detection content for this specific chain is generic rather than vendor-verified. This site's Detect and Hunt guidance for CVE-2026-81578 and CVE-2026-82078 is Sigma-matched and behavior-based, not a PaperCut-specific, independently verified detection rule. Next step: use the log review categories above as a starting hunt hypothesis and tune thresholds against your own PaperCut deployment's normal traffic before trusting any alert volume as a clean signal.

Finally, this is an active disclosure and details can change quickly, as the two-patch history already shows. The version numbers, KEV deadline, and exploitation details above reflect sources published through September 1, 2026. Confirm current guidance directly against PaperCut's security bulletin and the CISA KEV catalog entry before acting.