PaperCut is being exploited through two chained flaws, and for about half its installed base there is no patch at all

What is happening

PaperCut is investigating active exploitation of its print-management software. In its own words: "We are aware of confirmed customer incidents and are treating this matter with the highest priority."

Two things make this worse than a normal zero-day. The vulnerability is two flaws chained, and neither score on its own describes the risk. And for roughly half the installed base, there is no patch to apply at all.

The vendor found the flaw the hard way. Its bulletin says it reproduced the vulnerability using information from "a university customer’s security team and digital forensics and incident response team". This was discovered from a victim, not through coordinated disclosure.

Two scores that each understate the risk

Two scores that each understate the risk

CVE-2026-81578 is an authentication bypass in the web management interface, scored 8.8. Its vector is PR:N, no credentials, but its impact is limited: an unauthenticated request can reach administrative functions before access validation completes, which lets an attacker modify certain system configurations. On its own that is bad but bounded.

CVE-2026-82078 is unsafe dynamic class loading in the database connection utilities, scored 9.4. It instantiates database driver classes from configurable names without checking them against an allowlist, so arbitrary Java bytecode on the classpath runs as the PaperCut server process. But its vector is PR:H: it needs high privilege, specifically the ability to manipulate system configuration parameters.

Which is precisely what the first flaw grants. Chained, they are unauthenticated remote code execution, and no single number in the advisory says so. A team triaging by highest CVSS alone sees a 9.4 that appears to require privilege, and misjudges the urgency.

Half the estate cannot patch

This is the part that should change what you do this afternoon.

Who can actually patch

PaperCut’s advisory applies to all versions of PaperCut NG and MF, with fixes in 24.1.10, 25.0.13 and 26.0.5. For anything older, the bulletin’s own FAQ is blunt: asked whether there will be a release for NG/MF 23 and earlier, the answer is that "the recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version."

Huntress telemetry puts roughly 47% of the approximately 2,500 PaperCut installations it tracks on v23 or older. For that half, the guidance during an actively exploited zero-day is a major-version migration. That is a project, not a patch.

The first patch was bypassed

Anyone who patched promptly needs to check they patched twice.

The vendor is also explicit that this is not a normal release: "This is an emergency patch... We have not gone through our usual release process." Two regressions are acknowledged and unresolved at the time of writing, affecting SAML and the external database card and ID lookup. The lookup regression fails silently: the feature is disabled by default in Release 2, and the bulletin warns PaperCut "will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured." A control that reports itself as on while doing nothing is its own hazard.

What the attacks actually look like

The observed activity is narrower than the severity suggests, and worth stating precisely.

The two documented incidents

Date	What the attacker ran	Duration
26 August 2026	whoami and ver, via a base64-encoded command	Under two minutes
27 August 2026	whoami, ver and tasklist, before Release 2 shipped	Short session

In both cases attackers dropped Java class files into the PaperCut library directory to fingerprint the host and list directories, wrote output to a file, then deleted logs. No ransomware has been observed, and no threat actor has been named. Given PaperCut’s history that restraint matters: the 2023 flaw CVE-2023-27350 was used by multiple ransomware operations and is still in CISA’s catalogue with known ransomware use. Nobody has shown that here, and this site is not going to imply it.

The structural parallel is the sharper one anyway. In 2023 it was improper access control in a setup class, giving auth bypass and code execution as SYSTEM. In 2026 it is improper access control in a request-routing path, giving auth bypass chained into class loading and code execution as the server process. Same weakness class, same product, same outcome, three years apart.

Indicators, and the honest caveat attached to them

PaperCut publishes a short list: suspicious post-exploitation activity from pc-app.exe; missing, truncated or deleted server.log files; and two specific log entries, ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.

It attaches a caveat that deserves repeating verbatim: "The absence of the above indicators is not confirmation that a system has not been affected." No IP addresses and no file hashes have been published by anyone.

Neither CVE is in CISA’s Known Exploited Vulnerabilities catalogue at the time of writing, which is a gap rather than a reassurance given the vendor has confirmed exploitation. More oddly, CISA’s own machine-readable enrichment of both records still says Exploitation: none. Both scores are PaperCut’s own, and both CVEs sit in NVD with status "Received", so NIST has not analysed either.

What to do

The position

The useful lesson here is about how severity is communicated. Two CVEs were published with two accurate scores, 8.8 and 9.4, and the real risk is a third thing that neither number expresses: chained, they are unauthenticated code execution. CVSS scores a vulnerability, not a path, and attackers work in paths. This is the same shape as the MCP fragments that are each benign and only compose into an attack: every component measurement is correct and the composition is where the damage lives.

The operational lesson is harder and less satisfying. For roughly half of PaperCut’s installed base the answer to an actively exploited zero-day is not a patch but a migration, which means the real control is the network, applied today. It is worth noticing how often that is where these stories end: the fix is a project, the mitigation is a firewall rule, and the organisations that survive the week are the ones that never had the management interface facing the internet in the first place.