PaperCut RCE flaws exploited in the wild
Two PaperCut NG/MF vulnerabilities enabling unauthenticated remote code execution are being actively exploited, per PaperCut.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-81578 and CVE-2026-82078 as exploited in the wild.
CIS/MS-ISAC issued an advisory covering two vulnerabilities in PaperCut NG and PaperCut MF print management software, affecting all versions. The more severe issue, CVE-2026-81578, is an improper access control flaw that allows unauthenticated remote attackers to trigger administrative backend actions before access validation completes, enabling modification of system configuration. The second, CVE-2026-82078, is an unsafe dynamic class loading vulnerability in database connection utilities; because the application instantiates driver classes from configurable names without an allowlist, an attacker who can manipulate configuration parameters can achieve execution of arbitrary Java bytecode on the classpath — effectively chaining with the first flaw for remote code execution in the context of the PaperCut service account.
PaperCut has confirmed in-the-wild exploitation. Impact depends on the privilege level of the service account running PaperCut; accounts with administrative rights face the greatest risk of full system compromise, including data theft, modification, or new account creation. Devices not exposed to the public internet carry reduced risk, but internet-facing PaperCut MF/NG deployments — common in education, government, and enterprise print environments — should be treated as high priority for patching.
Recommended mitigations include immediate patching per PaperCut's updates, least-privilege configuration of service accounts, network segmentation/DMZ isolation of print servers from internal networks, vulnerability scanning, and penetration testing. Given PaperCut's history as a target for ransomware access brokers, defenders should prioritize remediation and monitor for anomalous administrative activity against exposed PaperCut instances.
Mentioned in this report
Detection guidance
PaperCut Service Executing Arbitrary Java Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
PaperCut service account spawning java.exe or javaw.exe with suspicious classpath or dynamic class loading indicators, consistent with unsafe dynamic class instantiation exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PaperCut Service Executing Arbitrary Java Process
description: Detects PaperCut (java.exe parent or running as PaperCut service account)
spawning additional Java processes with dynamic class loading or unusual classpath
arguments, typical of CVE-2026-82078 exploitation.
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_papercut_java_spawn:
ParentImage|endswith:
- \java.exe
- \javaw.exe
Image|endswith:
- \java.exe
- \javaw.exe
User|contains:
- papercut
- pc-
selection_papercut_dynamic_class:
ParentImage|endswith:
- \java.exe
- \javaw.exe
User|contains:
- papercut
- pc-
CommandLine|contains:
- -Dcom.sun.jndi.ldap
- Class.forName
- defineTransletClasses
- TemplatesImpl
filter_legitimate_papercut:
CommandLine|contains:
- org.apache.catalina
- org.springframework
condition: (selection_papercut_java_spawn or selection_papercut_dynamic_class) and
not filter_legitimate_papercut
falsepositives:
- Legitimate PaperCut plugin or extension loading during normal operation
- PaperCut cluster replication spawning Java worker processes
level: high
id: c7428798-1d69-58c6-825c-1cbeec5bee58
status: experimental
author: Vorant
PaperCut Database Connection Driver Manipulation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Process modification or file write to PaperCut configuration files (papercut-config.xml, server.properties) containing non-standard database driver class names or JNDI/LDAP injection payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PaperCut Database Connection Driver Manipulation
description: Detects writes to PaperCut configuration files with non-standard or malicious
database driver class specifications, exploiting unsafe dynamic class loading in
CVE-2026-82078.
tags:
- attack.t1190
- attack.execution
logsource:
category: file_event
product: windows
detection:
selection_papercut_config:
TargetFilename|contains:
- \\PaperCut
- papercut-config.xml
- server.properties
- db.properties
selection_suspicious_write:
TargetFilename|endswith:
- .xml
- .properties
Image|endswith:
- \notepad.exe
- \notepad++.exe
- \powershell.exe
- \cmd.exe
- \python.exe
filter_admin_maintenance:
User|contains:
- Administrator
- SYSTEM
CommandLine|contains:
- HKEY_LOCAL_MACHINE
condition: selection_papercut_config and selection_suspicious_write and not filter_admin_maintenance
falsepositives:
- Legitimate administrators editing PaperCut configuration via GUI or approved automation
- Scheduled backup or maintenance scripts modifying config during patching
level: medium
id: 4cc32692-1d90-5717-90fe-c0990354aa1c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-papercut-products-could-allow-for-remote-code-execution_2026-086
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs