VORANT. Threat Intelligence Sign in Get the full feed

PaperCut RCE flaws exploited in the wild

severe vulnerability educationgovernment-nationaltechnology

Two PaperCut NG/MF vulnerabilities enabling unauthenticated remote code execution are being actively exploited, per PaperCut.

CIS/MS-ISAC issued an advisory covering two vulnerabilities in PaperCut NG and PaperCut MF print management software, affecting all versions. The more severe issue, CVE-2026-81578, is an improper access control flaw that allows unauthenticated remote attackers to trigger administrative backend actions before access validation completes, enabling modification of system configuration. The second, CVE-2026-82078, is an unsafe dynamic class loading vulnerability in database connection utilities; because the application instantiates driver classes from configurable names without an allowlist, an attacker who can manipulate configuration parameters can achieve execution of arbitrary Java bytecode on the classpath — effectively chaining with the first flaw for remote code execution in the context of the PaperCut service account.

PaperCut has confirmed in-the-wild exploitation. Impact depends on the privilege level of the service account running PaperCut; accounts with administrative rights face the greatest risk of full system compromise, including data theft, modification, or new account creation. Devices not exposed to the public internet carry reduced risk, but internet-facing PaperCut MF/NG deployments — common in education, government, and enterprise print environments — should be treated as high priority for patching.

Recommended mitigations include immediate patching per PaperCut's updates, least-privilege configuration of service accounts, network segmentation/DMZ isolation of print servers from internal networks, vulnerability scanning, and penetration testing. Given PaperCut's history as a target for ransomware access brokers, defenders should prioritize remediation and monitor for anomalous administrative activity against exposed PaperCut instances.

Mentioned in this report

Vulnerabilities CVE-2026-81578KEVCVE-2026-82078KEV

Related reporting

Detection guidance

PaperCut Service Executing Arbitrary Java Process

ATT&CK T1190

PaperCut service account spawning java.exe or javaw.exe with suspicious classpath or dynamic class loading indicators, consistent with unsafe dynamic class instantiation exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PaperCut Service Executing Arbitrary Java Process
description: Detects PaperCut (java.exe parent or running as PaperCut service account)
  spawning additional Java processes with dynamic class loading or unusual classpath
  arguments, typical of CVE-2026-82078 exploitation.
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_papercut_java_spawn:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \java.exe
    - \javaw.exe
    User|contains:
    - papercut
    - pc-
  selection_papercut_dynamic_class:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    User|contains:
    - papercut
    - pc-
    CommandLine|contains:
    - -Dcom.sun.jndi.ldap
    - Class.forName
    - defineTransletClasses
    - TemplatesImpl
  filter_legitimate_papercut:
    CommandLine|contains:
    - org.apache.catalina
    - org.springframework
  condition: (selection_papercut_java_spawn or selection_papercut_dynamic_class) and
    not filter_legitimate_papercut
falsepositives:
- Legitimate PaperCut plugin or extension loading during normal operation
- PaperCut cluster replication spawning Java worker processes
level: high
id: c7428798-1d69-58c6-825c-1cbeec5bee58
status: experimental
author: Vorant

Unauthenticated Configuration Modification to PaperCut Backend

ATT&CK T1190

HTTP/HTTPS requests to PaperCut admin endpoints (api/*, /admin/*) that modify configuration without prior authentication token, or with HTTP 200/302 response before auth validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated Configuration Modification to PaperCut Backend
description: Detects HTTP requests modifying PaperCut system configuration via admin/API
  endpoints before authentication completes, consistent with CVE-2026-81578 improper
  access control.
tags:
- attack.t1190
- attack.execution
logsource:
  category: proxy
  product: web_proxy
detection:
  selection_papercut_admin_access:
    DestinationHostname|contains: papercut
    Url|contains:
    - /api/
    - /admin/
    - /Configure
    - /Settings
  selection_auth_bypass:
    HttpMethod: POST
    Url|contains: database
  filter_authenticated_session:
    HttpResponseCode: 200
    http_headers|contains: JSESSIONID
  condition: (selection_papercut_admin_access and selection_auth_bypass) and not filter_authenticated_session
falsepositives:
- Legitimate POST requests from authenticated admin sessions with valid JSESSIONID
- Automated monitoring/scanning tools with proper authorization headers
level: high
id: 3b0d9d09-ea58-51b6-aa9a-e9a69409f50e
status: experimental
author: Vorant

PaperCut Database Connection Driver Manipulation

ATT&CK T1190

Process modification or file write to PaperCut configuration files (papercut-config.xml, server.properties) containing non-standard database driver class names or JNDI/LDAP injection payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PaperCut Database Connection Driver Manipulation
description: Detects writes to PaperCut configuration files with non-standard or malicious
  database driver class specifications, exploiting unsafe dynamic class loading in
  CVE-2026-82078.
tags:
- attack.t1190
- attack.execution
logsource:
  category: file_event
  product: windows
detection:
  selection_papercut_config:
    TargetFilename|contains:
    - \\PaperCut
    - papercut-config.xml
    - server.properties
    - db.properties
  selection_suspicious_write:
    TargetFilename|endswith:
    - .xml
    - .properties
    Image|endswith:
    - \notepad.exe
    - \notepad++.exe
    - \powershell.exe
    - \cmd.exe
    - \python.exe
  filter_admin_maintenance:
    User|contains:
    - Administrator
    - SYSTEM
    CommandLine|contains:
    - HKEY_LOCAL_MACHINE
  condition: selection_papercut_config and selection_suspicious_write and not filter_admin_maintenance
falsepositives:
- Legitimate administrators editing PaperCut configuration via GUI or approved automation
- Scheduled backup or maintenance scripts modifying config during patching
level: medium
id: 4cc32692-1d90-5717-90fe-c0990354aa1c
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-papercut-products-could-allow-for-remote-code-execution_2026-086

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free