Two PaperCut zero-days chain into unauthenticated code execution and land on the KEV catalog

August 27, 2026. PaperCut Software published an urgent security advisory: it is investigating active exploitation of a flaw affecting PaperCut NG and PaperCut MF. August 28, 2026. The vendor assigned two CVE IDs — CVE-2026-81578 and CVE-2026-82078 — and shipped a first emergency patch. August 31, 2026. Both flaws entered CISA’s KEV catalog. In four days, a two-zero-day chain went from “unidentified flaw” to “exploited and emergency-patched”.

PaperCut NG/MF is a print-management platform deployed in enterprises, universities, and government. Its application server exposes a web administration interface — and that is exactly where the compromise happens. The chained pair yields unauthenticated remote code execution, which makes it a first-rank emergency for any exposed server.

Two flaws, one attack chain

CVE-2026-81578 is an authentication bypass (CWE-306, CVSSv4 8.8): a remote, unauthenticated attacker can modify certain system configuration settings. CVE-2026-82078 is unsafe dynamic class loading in the database connection utilities (CWE-470, CVSSv4 9.4, critical). It is the second link that turns the bypass into code execution.

The chain, documented by Rapid7, is a textbook case of flaw composition. The attacker first uses the bypass to reconfigure four external user-lookup settings — user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql, and user-lookup.enabled. These settings normally let an administrator connect PaperCut to an external card database. In the wrong hands they become a door: the attacker plants a malicious JDBC connection and an arbitrary SQL statement, then triggers the lookup, and code executes in the server’s context.

The Tapestry mechanics behind the bypass

The bypass leans on a subtlety of the Apache Tapestry framework that PaperCut is built on. Tapestry’s “complex direct” request format can name one page to display and a different page holding the component to execute. PaperCut validates access only on the displayed page. By selecting the public Error or Exception page for display, the attacker slips past authentication while invoking administrative components such as ConfigEditor or UserList.

The technical lesson runs deep: access validation was applied to the displayed object, not the executed one. It is a bug class invisible to functional tests and ordinary code review — you have to audit the layer that maps an HTTP request to the component actually invoked. Tellingly, the first emergency patch was bypassed the moment it shipped, using the Home page for display: only the second patch version actually closes the hole.

An emergency patch that was already bypassed

The patch sequence is itself a warning sign. On August 28, PaperCut shipped a first patch for versions 25 and 26, then 24. The same day, WatchTowr identified multiple patch bypasses and a second authentication bypass. PaperCut then published a second version of the patch. In plain terms: any organization that applied the first emergency patch is not protected and must apply the second immediately.

This is the classic trap of out-of-cycle fixes: shipped without the usual test battery, they can be incomplete. For a defender, the rule is simple — track the vendor advisory to its latest version, and never treat “patch applied” as “case closed” until the vendor confirms coverage.

The scale of exposure

The risk is not theoretical. The ShadowServer Foundation counts roughly 1,000 PaperCut instances currently exposed to the internet, mostly in North America and Europe. Huntress observed attacks against at least two customers, with the first attempts as early as August 26 — the day before the public advisory. Observed activity has so far focused on system discovery; no secondary malware or command-and-control traffic has been identified yet. But history urges caution: in 2023, CVE-2023-27350, a PaperCut RCE, was widely exploited by multiple groups, including ransomware operators.

The picture is thus a known target, a now-public exploit chain — a Metasploit module has been available since August 31 — and an exposed fleet on the order of a thousand servers. The window between technical disclosure and mass exploitation is measured in days, not weeks.

From SQL statement to command execution

The full chain is worth walking through, because it shows how seemingly harmless pieces assemble into RCE. After the authentication bypass, the attacker configures a malicious JDBC connection and an arbitrary SQL statement in the user-lookup settings. They then lean on PaperCut’s bundled Apache Derby driver: a CALL statement enabling Derby’s foreignViews feature opens an attacker-controlled H2 JDBC URL. H2 then processes an inline INIT statement that creates a database trigger backed by JavaScript. Because PaperCut ships the Nashorn engine, that trigger can launch an operating-system process — and arbitrary command execution follows.

The pedagogical point is real: no single building block is vulnerable by itself. It is their combination — auth bypass, reconfiguration, SQL, foreignViews, H2, Nashorn — that turns a configuration change into a shell. For a defender, that means defense in depth cannot stop at the authentication layer: you also have to watch what a modified configuration can trigger.

The traces to look for

PaperCut has published preliminary indicators of compromise. On the application side, alerts from IDS, EDR, or network-monitoring tools involving the PaperCut server — especially unusual post-exploitation activity from pc-app.exe — are the first signal. On the log side, two anomalies stand out: missing, truncated, or deleted server.log files, and entries such as “No suitable driver found for jdbc:no:x” or “DatabaseUtils - Database error looking up cardID: VALUES CAST”.

A counter-intuitive caveat: PaperCut notes that the absence of these indicators does not prove a server is clean. And because scheduled cleanup of unattached blobs can destroy evidence, forensic assessment should begin without delay. It is the logical corollary of a public exploit chain: an exposed server must be treated as potentially compromised until proven otherwise, not the reverse.

For defenders, the uncomfortable part of this timeline is how little lead time there was. The first exploitation attempts observed by Huntress predate the public advisory by a day, and at the moment of disclosure the vendor had no CVE, no CVSS, and no technical detail. That is the definition of a zero-day: the patch curve starts from zero while the attackers are already inside. PaperCut also treats every version as affected, which means there is no safe legacy build to hide behind — the emergency patches span versions 24, 25, and 26 precisely because nothing older is considered trustworthy. Notably, the root cause was unlocked by a university customer’s security and forensics team, whose evidence let PaperCut reproduce the flaw — a reminder that victim-side forensics, not just vendor research, often surfaces the actual mechanism.

Verdict

If you run PaperCut NG or MF, apply the second emergency patch immediately — the first is bypassable. If your server is internet-reachable, restrict web access to trusted address ranges now, via firewall, reverse proxy, or network access controls, while waiting for the final fix. If you applied the first patch version, treat your server as potentially compromised: watch pc-app.exe, truncated or deleted server.log files, and suspicious entries such as “No suitable driver found for jdbc:no:x” or “DatabaseUtils - Database error looking up cardID”.

References

• More Details Emerge on Exploited PaperCut Vulnerabilities — SecurityWeek, August 31, 2026
• PaperCut NG/MF Critical Zero-Day Exploited in the Wild — Rapid7, August 28, 2026
• URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) — PaperCut
• PaperCut NG/MF zero-day: active exploitation — Qualys Threat Protect, August 31, 2026