Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) and threat intelligence researchers have issued an urgent warning regarding the active exploitation of two zero-day vulnerabilities affecting PaperCut NG and PaperCut MF print management software. Tracked as CVE-2026-82078 (CVSS 9.8) and CVE-2026-81578 (CVSS 7.5), the vulnerabilities allow unauthenticated remote threat actors to bypass authentication boundaries, alter server configuration databases, and execute arbitrary system commands with elevated system privileges. CISA has formally added the vulnerability chain to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal civilian executive branch agencies to patch or isolate affected servers immediately.
Deep-Dive Technical Analysis
Vulnerability Chaining & Remote Code Execution Mechanics
PaperCut NG/MF is widely deployed across educational institutions, healthcare systems, government bodies, and Fortune 500 enterprises to manage centralized networked printing and document scanning workflows.
Technical dissection of the attack chain reveals how adversaries achieve unauthenticated Remote Code Execution (RCE) by linking the two flaws:
1. CVE-2026-81578: Unauthenticated Configuration Modification:
- The first flaw resides in the PaperCut application server's setup and database management web interface.
- An unauthenticated remote attacker can submit crafted HTTP POST requests to an exposed initialization handler that fails to enforce access-control state checks after initial deployment.
- This allows the attacker to arbitrarily overwrite internal database connection strings and system property tables without providing administrative credentials.
2. CVE-2026-82078: Insecure Dynamic Class Loading in Database Connectors:
- Once the database connection string is manipulated via the first flaw, the attacker points the connection property to an attacker-controlled external database endpoint (such as a rogue H2, PostgreSQL, or MySQL listener).
- When PaperCut's backend Java Virtual Machine (JVM) attempts to initialize the database connection, it triggers an unsafe dynamic class loading routine within its database utility classes.
- The connector parses attacker-supplied parameters containing remote Java class references, instantiating arbitrary bytecode directly into memory.
3. Privilege Elevation & Command Execution:
- Because the PaperCut service typically runs with elevated operating system permissions (such as `NT AUTHORITY\SYSTEM` on Windows or `root` on Linux) to manage printer spoolers and drivers, the loaded bytecode inherits full machine-level privileges.
- Threat actors instantly spawn reverse command shells, dump Active Directory service accounts stored in PaperCut memory, and disable local endpoint protection agents.
Threat Intelligence & Ransomware Targeting
Telemetry from digital forensics and incident response (DFIR) teams indicates that Initial Access Brokers (IABs) and ransomware syndicates (including affiliates linked to BlackSuit and BianLian) are actively scanning the IPv4 address space for vulnerable PaperCut instances on ports 9191 and 9192:
- Historical Precedent: The exploitation pattern mirrors previous PaperCut zero-day campaigns (such as CVE-2023-27350), where mass scanning led to domain-wide ransomware deployments within hours of initial server compromise.
- Internal Network Pivot: Print servers frequently interface with domain controllers and file servers, making an unpatched PaperCut server an ideal staging ground for enterprise-wide lateral movement.
Actionable Recommendations & Mitigations
1. Apply Official Security Updates Immediately: Administrators must upgrade PaperCut NG and PaperCut MF instances immediately to versions 24.0.3, 23.0.9, 22.1.5, or later, which completely sanitize database connector strings and enforce strict class loading restrictions.
2. Block Inbound External Traffic to Print Ports: Ensure that PaperCut web management ports (TCP 9191, 9192, 9193, and 9195) are strictly inaccessible from the public internet. Block these ports at the perimeter firewall and restrict access strictly to internal management subnets.
3. Inspect Application and Web Server Logs: Review PaperCut `server.log` and HTTP access logs for unauthorized POST requests directed at database configuration paths, specifically checking for anomalous external IP addresses or unexpected changes in database driver properties.
4. Implement Principle of Least Privilege for Service Accounts: Reconfigure PaperCut service daemons to run under dedicated, low-privileged service accounts rather than `SYSTEM` or `root`, limiting the blast radius of any successful exploit.
---
Sources & References: CISA Known Exploited Vulnerabilities Catalog, SecurityWeek, PaperCut Security Bulletins.