Enterprise Print Management Zero-Day: PaperCut Actively Exploited via Pre-Auth RCE Vulnerability Chain
Executive Summary
Print management software vendor PaperCut and cybersecurity firm Huntress Labs published an urgent security advisory on August 27, 2026, warning that a critical pre-authentication remote code execution (RCE) vulnerability chain in PaperCut NG and PaperCut MF is under active in-the-wild exploitation. The vulnerability allows unauthenticated, network-positioned attackers to manipulate internal server configuration endpoints, abuse Java database reflection routines, and execute arbitrary code with full NT AUTHORITY\SYSTEM or root operating system privileges. Huntress confirmed active exploitation across production client environments, where attackers executed reconnaissance commands and deployed self-deleting Java class payloads. PaperCut has released emergency patched builds (25.0.12.76497 and 25.0.12.76496) and urged organizations to eliminate public internet exposure immediately.
Technical Breakdown of the PaperCut Pre-Auth RCE Chain
The exploit chain leverages a fundamental authorization mismatch in PaperCut's web interface request dispatching:
1. Authorization Desynchronization & Remote Configuration Takeover
The vulnerability resides in how the PaperCut Application Server handles multi-part component requests:
* The Authorization Discrepancy: In unpatched versions, a crafted HTTP request can specify one URL path rendered for the visual response while targeting a completely different internal component or administrative action for execution.
* Missing Permission Enforcement: PaperCut's access control layer validates permissions against the benign rendered page rather than the underlying component being executed, allowing unauthenticated attackers to modify backend server configuration properties without logging in.
2. Java Reflection & In-Memory Derby Database Code Execution
Once attackers gain unauthorized configuration control, they leverage Java reflection routines to achieve arbitrary code execution:
* Malicious JDBC Connection String Injection: Attackers configure the application to connect to an external, attacker-controlled SMB2 share hosting a crafted Apache Derby database archive, generating log entries such as DB URL: jdbc:derby:memory:pwn.
* Payload Execution & Antiforensic Log Deletion: The server loads malicious compiled Java class files (e.g., Udydn.class) into memory under pc-app.exe. Post-exploitation activity observed by Huntress included base64-encoded discovery commands (whoami & ver & tasklist), followed by automated scripts that deleted the dropped .class and .out files, server.log, and /data/internal/derby.log to hinder forensic response.
Vulnerability Snapshot
Feature
Details
Affected Software
PaperCut NG & PaperCut MF (All versions prior to emergency patch builds)
Emergency Releases
PaperCut NG 25.0.12.76497 & PaperCut MF 25.0.12.76496 (Windows/Linux)
Vulnerability Class
Improper Authorization (CWE-285) / Remote Code Execution (CWE-94)
Severity
Critical (CVSS 9.8)
Disclosed by
PaperCut Security Advisory & Huntress Threat Research (August 27, 2026)
Why Print Servers Remain Prime Lateral Movement Hubs
Enterprise print management servers occupy a unique, highly privileged position within corporate networks: they are integrated with Active Directory domains, process sensitive document data from every department, and hold elevated system credentials across thousands of networked endpoints. When an edge or internal print server is compromised via pre-auth RCE, attackers obtain an immediate springboard for domain credential harvesting, lateral network traversal, and ransomware deployment.
Organizations must treat print management infrastructure with the same operational security tier as domain controllers and identity providers.
Recommendations and Mitigations
IT administrators, DevSecOps teams, and security operations centers should execute the following emergency remediation protocol immediately:
1. Deploy Emergency PaperCut Upgrades: Upgrade all PaperCut NG and MF installations to build 25.0.12.76497 / 25.0.12.76496 (or apply incoming version 24 emergency fixes as they publish).
2. Eliminate All Public Internet Ingress: Ensure PaperCut Application Server web interfaces (ports 9191/9192) are completely unreachable from the public internet; place all administrative access behind a secure VPN with multi-factor authentication.
3. Restrict Outbound SMB Egress (Port 445): Block outbound SMB (TCP port 445) connections originating from PaperCut host servers to external networks to prevent remote Derby database archive loading.
4. Hunt for Indicators of Compromise (IoCs): Inspect server.log and process creation telemetry for child processes spawned under pc-app.exe (such as cmd.exe, powershell.exe, or charmap.exe) and search for strings matching jdbc:derby:memory:.