Executive Summary
PaperCut Software has published an emergency out-of-band security advisory alongside the release of urgent patches to mitigate two critical vulnerabilities impacting all versions of PaperCut NG and PaperCut MF print management software. The flaws—tracked as CVE-2026-81578 (Missing Authentication in Critical Function) and CVE-2026-82078 (Untrusted Input Deserialization / Remote Code Execution)—are under active, in-the-wild exploitation by sophisticated threat actors. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an immediate operational warning, adding both flaws to its Known Exploited Vulnerabilities (KEV) catalog and directing federal agencies to apply the vendor updates immediately.
Deep-Dive Technical Analysis
Vulnerability Breakdown: CVE-2026-81578 and CVE-2026-82078
PaperCut NG and PaperCut MF serve as centralized enterprise print management and document scanning hubs, commonly deployed on internet-facing Windows and Linux application servers.
1. CVE-2026-81578 (CVSS 9.8 - Missing Authentication in Central Management Endpoint)
* Root Cause: A critical flaw in the URL routing logic of the web application server fails to enforce authentication checks on specific administrative API endpoints accessible via default ports 9191 (HTTP) and 9192 (HTTPS).
* Exploit Vector: An unauthenticated remote attacker can issue crafted HTTP POST requests to these endpoints, bypassing session validation routines and gaining direct access to sensitive system administration functions.
2. CVE-2026-82078 (CVSS 9.8 - Untrusted Input Deserialization & RCE)
* Root Cause: Insecure handling and deserialization of untrusted user input within the server-side print job synchronization handler.
* Exploit Vector: By chaining the authentication bypass in CVE-2026-81578 with this deserialization flaw, attackers can inject serialized Java or binary payloads that execute arbitrary system commands in the security context of the PaperCut Application Server service—which runs under high-privilege NT AUTHORITY\SYSTEM on Windows or root on Linux.
Active Threat Campaigns & Lateral Movement
Telemetry from threat intelligence firms indicates that initial exploitation begins with automated reconnaissance scans sweeping public IP ranges for exposed PaperCut web interfaces. Once code execution is established:
* Attackers drop persistent web shells (such as customized JSP backdoors) into the PaperCut web root directory ([app-path]/server/custom/web).
* Attackers spawn child processes from the parent process pc-app.exe (e.g., cmd.exe, powershell.exe, or bash).
* The attackers dump local LSASS process memory to harvest domain credentials, execute internal Active Directory reconnaissance, and establish persistent Command and Control (C2) beacons using Cobalt Strike or Sliver.
Industry Impact & Critical Recommendations
The High-Value Target of Enterprise Print Infrastructure
Print management servers are uniquely vulnerable and highly prized by cybercriminals because they bridge corporate workstation subnets with domain controllers, user directories, and sensitive document queues. Compromise of a primary PaperCut server frequently provides an immediate stepping stone for widespread corporate ransomware deployment.
Strategic Recommendations & Technical Mitigations
Action Item
Mitigation Description
Apply Patches
Upgrade all PaperCut NG and MF installations to the latest maintenance release (Release 2 hotfixes) without delay.
Network Exposure
Ensure PaperCut web administrative interfaces (ports 9191, 9192, and 9193) are strictly inaccessible from the public internet.
Access Control
Place print management servers behind an authenticated VPN or Zero Trust Network Access (ZTNA) perimeter.
EDR Auditing
Configure EDR solutions to trigger high-priority alerts on suspicious child processes spawned by pc-app.exe or Java runtime binaries.
Forensic Audit
Conduct file-integrity audits of the application directory to detect unauthorized .jsp, .class, or executable scripts in the web directory.
Least Privilege
Reconfigure the PaperCut service to execute under a dedicated, low-privileged service account rather than NT AUTHORITY\SYSTEM.