PaperCut zero-days actively exploited for RCE

28 August 2026 high vulnerability technology

ANSSI warns actively exploited PaperCut MF/NG vulnerabilities allow authentication bypass and remote code execution; patches urgently recommended.

CERT-FR has issued an advisory covering multiple vulnerabilities in PaperCut MF and NG print management software, affecting all versions prior to 24, 25, or 26 without the vendor's temporary security patch. The flaws allow an attacker to bypass authentication and execute arbitrary code remotely. PaperCut has confirmed these vulnerabilities are being actively exploited in the wild, prompting an urgent security bulletin from the vendor on 27 August 2026 and corroborating research from Rapid7.

The vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078, relate to SQL query handling for Card/ID number lookups against external databases; the vendor's patch blocks queries containing EXEC, EXECUTE, or CALL statements. CERT-FR strongly recommends applying vendor patches immediately. As an interim mitigation, PaperCut recommends restricting access to the application server to trusted IP addresses via firewall rules.

Defenders should monitor security tooling for anomalous activity involving pc-app.exe, check for missing, truncated, or deleted server.log files, and search logs for the error patterns 'ERROR No suitable driver found for jdbc:no:x' and 'ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST'. PaperCut notes that the absence of these indicators does not confirm the vulnerabilities were not exploited, so organizations should not rely solely on log review to rule out compromise.

Mentioned in this report

Vulnerabilities CVE-2026-81578KEVCVE-2026-82078KEV

Detection guidance

PaperCut Server Log Deletion or Truncation

ATT&CK T1070.004

Detects deletion or truncation of PaperCut server.log files, common post-exploitation cleanup to remove evidence of CVE-2026-81578/82078 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PaperCut Server Log Deletion or Truncation
description: Detects deletion, truncation, or renaming of PaperCut server.log files
  following exploitation of CVE-2026-81578 or CVE-2026-82078. Attackers often remove
  or truncate logs to hide evidence of SQL injection RCE.
tags:
- attack.defense-evasion
- attack.t1070.004
logsource:
  category: file_event
  product: windows
detection:
  selection_delete:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - server.log
    - server.log.
    CommandLine|re: (del |rm |Remove-Item|erase ).*server\.log
  selection_truncate:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: server.log
    CommandLine|re: (type nul >|\$null >|>.*server\.log)
  filter_legitimate_admin:
    User|contains:
    - SYSTEM
    - NETWORK SERVICE
    ParentImage|endswith:
    - \services.exe
    - \svchost.exe
  condition: (selection_delete or selection_truncate) and not filter_legitimate_admin
falsepositives:
- Legitimate log rotation or archival by PaperCut administrative tools
- System administrators manually clearing logs for maintenance
level: high
id: d3eaf573-b79e-55e7-9d41-ee2f275ab828
status: experimental
author: Vorant

PaperCut SQL Injection via Card ID Lookup

ATT&CK T1190

Detects SQL injection payloads in PaperCut Card/ID number lookups containing EXEC, EXECUTE, or CALL statements used to exploit CVE-2026-81578/82078. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PaperCut SQL Injection via Card ID Lookup
description: Detects exploitation of CVE-2026-81578/82078 SQL injection vulnerabilities
  in PaperCut MF/NG Card/ID lookup functionality. Rules block queries with EXEC, EXECUTE,
  CALL statements injected into the Card ID parameter.
tags:
- attack.t1190
logsource:
  category: proxy
  product: any
detection:
  selection:
    dst_ip|contains:
    - :9191
    - :8080
    - :9192
    http_request_method: POST
    url|contains:
    - userCheck
    - cardLookup
    - cardID
    http_request_body|re: (?i)(cardID|id_number|card_number).*(EXEC|EXECUTE|CALL)\s*\(
  condition: selection
falsepositives:
- Legitimate database administration tools querying PaperCut via stored procedures
  (rare)
level: critical
id: 865a12f4-dd86-52c9-97bb-05c015d3c616
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1095

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free