PaperCut Confirms Two Chained Zero-Days Exploited Across All NG and MF Versions

PaperCut is telling every customer running its print-management software to treat this as an emergency: attackers are actively exploiting two chained zero-day vulnerabilities that affect all versions of PaperCut NG and PaperCut MF, and the fix is an out-of-cycle patch the company shipped in the middle of the night.

The vendor confirmed the attacks in an urgent security advisory first posted on August 27, 2026, saying it is "aware of confirmed customer incidents and is treating this matter with the highest priority." Over the next day and a half the picture sharpened. Two CVEs were assigned, outside researchers reproduced a full remote-code-execution chain, and PaperCut replaced its first emergency build with a hardened second one. If you operate a PaperCut Application Server, the practical takeaway is simple and time-sensitive: apply Release 2 for v24, v25, or v26 now, or take the server off the public internet until you can.

Updated September 14, 2026: PaperCut has replaced the emergency patches described below with Regular Maintenance Releases that went through its full QA cycle. Organisations still running an emergency patch build are expected to move to a maintenance release. The section at the end of this article covers what that means for teams that already patched, and the triage figure below now names the current builds. Everything else is the original August 28 reporting, unchanged.

What PaperCut Is Telling Customers

PaperCut disclosed the problem before it had CVE identifiers, CVSS scores, or a named vulnerability class, which is unusual and tells you how fast this moved. Rapid7 noted in its emergency write-up that the initial advisory shipped without those standard fields, a sign the vendor chose speed over completeness once it had confirmed real intrusions. The company’s "security emergency response team" reproduced the flaw using forensic data supplied by a university customer that had been hit, then rushed builds out the door.

At 2:10 a.m. AEST on August 28, 2026, PaperCut released emergency, out-of-cycle builds for both the v25 and v26 branches of NG and MF, covering the Windows, Linux, and macOS installers, as SecurityWeek reported. Within hours the company published an updated Emergency Patch, labeled Release 2, extending coverage to the v24, v25, and v26 branches of both products. PaperCut presented Release 2 as additional hardening, but the reason it exists is sharper than that: researchers at watchTowr and Huntress each found multiple bypasses of the original emergency patch, along with an additional authentication bypass flaw, and Release 2 is the fix for those, as reported by BleepingComputer. The instruction to defenders is unchanged and now correctly motivated: install Release 2 even if you already applied the original emergency patch, because the original patch can be bypassed.

The single most important thing to know is that there is no unaffected version. This is not a "patch if you are on an old build" situation. Every deployment of PaperCut NG and PaperCut MF is in scope until it is patched or walled off.

Figure: The first-hour decision for anyone running a PaperCut Application Server. Upgrade to the current maintenance release, or isolate the server before doing anything else.

What the Two CVEs Actually Are

The attacks chain two distinct flaws, and the numbering is worth getting right because early reporting varied. Per PaperCut’s own advisory and Help Net Security, the pair is CVE-2026-82078 and CVE-2026-81578.

CVE-2026-82078 stems from unsafe dynamic class loading in the database connection utilities of PaperCut MF and PaperCut NG. In plain terms, it lets an attacker get the server to run arbitrary Java bytecode, which is a remote-code-execution primitive. CVE-2026-81578 is an improper access control flaw in the web management interface. It lets an unauthenticated remote attacker modify certain system configurations. Used together, the access-control gap opens the door and the class-loading flaw runs code behind it. PaperCut has since published CVSS 4.0 scores for both: CVE-2026-82078 is rated 9.4 (Critical) and CVE-2026-81578 is rated 8.8 (High).

Security firm Huntress, which worked with PaperCut on the response, said it "reproduced a pre-authentication, remote configuration takeover and a complete remote code execution chain against a stock installation of PaperCut NG 25.0.11.75758," the previous public build in the 25.0 line. That is the key qualifier for defenders: the researchers describe the chain as pre-authentication, meaning an attacker does not need valid credentials to start. Huntress reported seeing exploitation in two customer environments, with post-exploitation activity that ran basic reconnaissance commands to identify the account and operating system on the compromised host.

Who Is Affected

PaperCut NG is print-management software widely deployed in offices, schools, universities, and government. PaperCut MF is the multi-function variant that ties into the big all-in-one copiers, running from the machine’s touchscreen and integrating with hardware from most major printer brands. Both share the same Application Server, which the vendor describes as the "brain" of the deployment, and organizations typically run just one.

That concentration is exactly why this matters. A single exposed Application Server is often the control point for every managed printer in a building or campus, and print servers tend to sit on internal networks with broad reach. This is not the first time PaperCut has drawn ransomware attention: in 2023, affiliates of the Clop and LockBit operations exploited CVE-2023-27350 to deploy ransomware, a campaign serious enough to land in CISA’s Known Exploited Vulnerabilities catalog. The 2026 flaws are a fresh pair, not a rerun of that bug, but the target profile is the same.

What We Still Do Not Know

Several facts remain open, and I am flagging them rather than filling the gaps. Attribution is unknown. The Hacker News noted there are "currently no details about the flaw, how it is being exploited, or who is behind the efforts," and no threat group has been named. No specific victim organizations have been publicly identified beyond the anonymized university customer whose forensic data seeded the fix.

The CISA question is now settled. On August 31, 2026, CISA added both CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities catalog, listing CVE-2026-82078 as a PaperCut NG/MF unsafe reflection vulnerability and setting a remediation deadline of September 14, 2026 for US federal civilian executive branch agencies. Federal agencies are now on a binding clock. Everyone else should read that date as the outside edge of reasonable rather than a target. Because this is a developing story, expect details to shift, and check the vendor advisory for the current build numbers.

What Defenders Should Do Now

• Patch to Release 2 immediately. Apply the v24, v25, or v26 Emergency Patch (Release 2) to your PaperCut NG or MF Application Server, on Windows, Linux, or macOS. Install Release 2 even if you already applied the first emergency patch, because researchers bypassed that first patch. Superseded September 14, 2026: the maintenance releases described at the end of this article replace all emergency patch builds.
• If you cannot patch this hour, isolate the server. Take the Application Server offline, or restrict its web interfaces to trusted internal IP addresses using firewall rules or network access controls. PaperCut’s guidance is to do this "even if you have not observed suspicious activity."
• Get PaperCut off the public internet, permanently. An Application Server should not be reachable from untrusted addresses. If yours is, that is the exploited surface, and internet exposure should be treated as an incident-worthy misconfiguration once this is over.
• Hunt in the logs. Review the PaperCut server.log for files that are missing, truncated, or deleted, and for the two error strings the vendor flagged: ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST. Watch endpoint and network alerts tied to the Application Server, particularly suspicious activity from the pc-app.exe process.
• Assume compromise if you were exposed. A server that sat on the internet before patching should be investigated, not just updated. This is where fast, disciplined incident response earns its keep.

If you manage patch priorities across a large estate, this belongs at the top of the queue today. It has the three ingredients that make a flaw dangerous in practice: confirmed exploitation, no authentication requirement, and a target that is everywhere. That combination is the reason a mature vulnerability management program treats "actively exploited zero-day" as a different category from routine patching, and why understanding the difference between a zero-day exploit, a vulnerability, and an attack changes how fast you move.

My read: This is an assessment, not a reported fact. The riskiest thing about this one is not the exploit chain, it is the deployment pattern. PaperCut servers are boring infrastructure that nobody thinks about until they break, they often run with generous internal network access, and a meaningful number are exposed to the internet by teams who never intended them to be. That is the same setup that made the 2023 PaperCut bug a ransomware on-ramp. The vendor moved fast and communicated clearly here, and the patch story is good. The failure mode will be organizations that do not know they run PaperCut, or do not know their server is internet-facing, and therefore never see the advisory in time.

For related recent cases of enterprise software exploited within days of disclosure, see our coverage of GitLab CVE-2026-19478 exploited days after disclosure and Shadowserver’s count of compromised Zimbra servers.

Updated August 28, 2026: PaperCut assigned CVE-2026-82078 and CVE-2026-81578, and released Emergency Patch Release 2 with additional hardening. Install Release 2 even if the first patch was already applied.

Updated August 29, 2026: Two corrections from the vendor advisory. Emergency Patch Release 2 is available for v24 as well as v25 and v26, on Windows, Linux, and macOS; an earlier version of this article listed only v25 and v26. PaperCut has also now published CVSS 4.0 scores, 9.4 (Critical) for CVE-2026-82078 and 8.8 (High) for CVE-2026-81578, which this article previously reported as unpublished. PaperCut is separately investigating reports of post-patch issues affecting Card/ID number lookup and SAML.

Updated September 1, 2026: A correction to why Release 2 exists. This article previously described it as adding hardening beyond the first fix. That understates it. PaperCut shipped Release 2 after researchers broke the original emergency patch: watchTowr and Huntress each found multiple bypasses of it, plus an additional authentication bypass flaw, per BleepingComputer and SecurityWeek. If you applied the first patch and closed the ticket, reopen it, because you may still be exploitable. Three further details have since emerged. Huntress puts the first exploitation attempts at August 26, 2026, and says the observed activity focused on system discovery, with no secondary malware, command-and-control traffic or additional persistence recovered from the payload. The root causes are now public: CVE-2026-82078 loads database driver classes from configurable driver names without validating them against an approved allowlist, and CVE-2026-81578 lets unauthenticated remote requests aimed at administrative functions trigger backend actions before access-validation checks finish. And CISA added both CVEs to the KEV catalog on August 31, 2026, with a federal remediation deadline of September 14, 2026, which closes the open question this article carried. The general lesson is worth stating once: treat an emergency out-of-cycle patch as provisional, and keep watching the advisory for revisions for at least a week rather than closing the ticket on first application.

The Emergency Patches Have Been Superseded, and the Teams That Moved Fastest Are Most Likely to Miss It

Added September 14, 2026. PaperCut has replaced every emergency patch it shipped for CVE-2026-81578 and CVE-2026-82078 with Regular Maintenance Releases, and the fix you installed in late August is no longer the build the vendor wants you on. PaperCut's own security bulletin, updated on September 10, 2026, announces NG/MF 26.0.5, 25.0.13 and 24.1.10 and describes them as Regular Maintenance Releases that have been through complete QA testing, containing all of the security fixes issued in Emergency Patch Releases 1, 2 and 3 plus additional security hardening. The vendor's instruction is explicit: these releases replace the emergency patches, and anyone running an emergency patch build should move to a maintenance release.

Map your branch to the right release: 26.0.x goes to 26.0.5, 25.0.x to 25.0.13, and 24.1.x to 24.1.10. Both NG and MF ship all three, on Windows, Linux and macOS. Confirm against the bulletin before you schedule the change, because these supersede the emergency builds rather than sitting alongside them.

Here is the part worth stopping on. There are two populations exposed to this story, and the usual assumption about which one is in more trouble is backwards. A team that has not patched at all is going to get caught by the next vulnerability scan, the next KEV review, or the next auditor. A team that applied the emergency patch within hours of the August bulletin will read the headline "PaperCut ships maintenance releases," conclude it already handled this one, and stay on a superseded build indefinitely. The fast responders get no backstop. Diligence is what produces the stale state, which is why the action item here is check which build you are running, not check whether you patched.

That matters beyond tidiness, and this is assessment rather than vendor guidance: emergency builds ship without a full QA cycle by definition, and PaperCut shipped two of them in under 48 hours in late August because attackers worked around the first. Leaving a fleet parked on hotfix builds means running an untested configuration on a print server that sits inside the network perimeter. That is an operational-risk problem as much as a security one, and it is the reason a version-bump announcement deserves a defender's attention at all.

None of this closes the incident. Both flaws were exploited before any fix existed, in a campaign that reached at least 395 organisations across 48 countries using hundreds of AI agents. Any instance that was internet-reachable during the exposure window still needs the compromise assessment set out earlier in this article, and moving to a maintenance release does not retire that work. Treating a superseded-build migration as a tracked remediation item rather than a routine upgrade is ordinary vulnerability management discipline, and it is the part that most often gets skipped once a team believes it has already responded.

Primary Documents

• PaperCut, URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
• CISA, Known Exploited Vulnerabilities Catalog (both CVEs added 31 Aug 2026)
• Rapid7, PaperCut NG/MF Critical Zero-Day Exploited in the Wild
• SecurityWeek, PaperCut Releases Emergency Patch for Exploited Zero-Day
• SecurityWeek, More Details Emerge on Exploited PaperCut Vulnerabilities
• BleepingComputer, PaperCut releases second emergency patch for exploited flaws
• Huntress, PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE