Executive Summary
On August 27–28, 2026, print management software provider PaperCut issued an urgent, high-priority security advisory alerting enterprise administrators to active in-the-wild exploitation of two critical zero-day vulnerabilities affecting all unpatched versions of PaperCut NG and PaperCut MF. Tracked under CVE-2026-82078 and CVE-2026-81578, these flaws create a chained pre-authentication remote code execution (Pre-Auth RCE) vulnerability that allows unauthenticated network attackers to execute arbitrary system code with the high privileges of the PaperCut Application Server service account (often SYSTEM on Windows or root on Linux).
Security researchers and threat hunting teams, including Huntress and Rapid7, have observed automated exploit bots scanning public IPv4 address spaces and actively weaponizing the zero-day to drop persistent web shells, harvest active directory credentials, and deploy ransomware loader beacons.
Deep-Dive Technical Analysis
Vulnerability Vector & Architectural Weakness
PaperCut NG and MF operate centralized application servers that manage enterprise print queues, user quotas, and badge authentication across multi-function printers (MFPs). The core vulnerability resides within the application's external API routing and servlet authentication handler:
1. Authentication Bypass (CVE-2026-81578): A path normalisation and parameter parsing disparity in the web application framework allows external HTTP/HTTPS requests to reach internal administrative servlets (/app?service=page/...) without establishing an authenticated session. By manipulating request URI delimiters, attackers bypass the standard session token validation filters.
2. Arbitrary Code Execution (CVE-2026-82078): Once the authentication filter is bypassed, the attacker invokes an exposed internal configuration endpoint capable of processing deserialized XML/JSON objects. The endpoint fails to enforce strict type checking on uploaded job-rendering plug-in archives, allowing arbitrary executable binary payloads or JSP web shells to be written directly into the application server's web root ([install-path]/server/custom/web/...).
3. Execution Context: Because the PaperCut service runs with elevated system rights by default, the spawned shell immediately inherits NT AUTHORITY\SYSTEM permissions on Windows hosts, requiring no local privilege escalation steps.
Observed Exploitation & Attack Sequence
Forensic telemetry indicates that threat actors are executing the following standardized kill chain:
* Reconnaissance: High-frequency GET probes targeting default PaperCut ports 9191 (HTTP) and 9192 (HTTPS).
* Payload Delivery: Automated POST requests delivering obfuscated JSP web shells (often disguised as printer driver metadata files).
* Post-Exploitation Activity: Immediate execution of PowerShell / bash commands to disable endpoint telemetry, dump LSASS memory tables, and download secondary staging payloads from external command-and-control (C2) servers.
Industry Impact & Threat Context
PaperCut software is pervasive across healthcare, education, legal, and government environments where multi-tenant shared printing is critical. The exposure of public-facing PaperCut management consoles provides attackers with an instantaneous foothold inside enterprise perimeters. Similar to the historic PaperCut exploitation waves of 2023, unpatched instances are being rapidly absorbed into initial access broker (IAB) inventories and leveraged for enterprise ransomware deployment.
Recommendations & Mitigation Strategies
To secure your infrastructure against these active threats, the following actions are recommended:
Mitigation Action
Technical Detail / Version Target
Immediate Patching
Upgrade to PaperCut NG/MF version 25.0.3, 24.0.8, or 23.0.12
Network Segmentation
Restrict access to ports 9191, 9192, and 9193 to internal subnets or VPN
File System Audit
Inspect /server/custom/web/ and /server/tmp/ for unauthorized .jsp or .class files
EDR Monitoring
Flag child processes of pc-app.exe or app-server (e.g., powershell, cmd, bash)
Continuous Monitoring
Administrators should monitor process execution trees specifically for anomalous child processes spawned by the PaperCut Application Server. High-risk processes include powershell.exe, cmd.exe, wscript.exe, bash, or curl. Any identified unauthorized file creation in the web root or unexpected outbound network traffic from the application server should be treated as a confirmed compromise.