PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE-2026-82078 & CVE-2026-81578)

PaperCut released an Urgent Security Advisory to address two actively exploited vulnerabilities, tracked as CVE-2026-82078 & CVE-2026-81578, impacting all versions of PaperCut NG and PaperCut MF. When chained together, these vulnerabilities can enable pre-authentication remote code execution in the PaperCut Application Server. The flaw originates from a request-confusion/authorization gap.

The vendor has mentioned in their advisory that “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing.”

PaperCut is a software platform used by offices, schools, and businesses to track, manage, and control printing and copying. PaperCut NG (Next Generation) focuses strictly on computer and server-based print tracking, quotas, and cost control. PaperCut MF (Multi-Function) includes everything in NG plus embedded software that connects directly to large all-in-one office copiers to securely track and control scanning, copying, and faxing via touchscreen or card reader.

CVE-2026-81578

This is an improper access control vulnerability in the web management interface that may allow an unauthenticated attacker to modify system configurations. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete.

CVE-2026-82078

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. An attacker can manipulate system configuration parameters, leading to arbitrary Java bytecode execution from the application classpath under the security context of the PaperCut server process.

Indicators of Compromise

The following may be indicators of compromise:

• Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe.
• Missing, unexpectedly truncated, or deleted PaperCut server.log files.
• Any of the following entries in server.log:

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Strings in server.log:

• DB URL: jdbc:derby:memory:pwn;create=true
• Database error looking up cardID: VALUES CAST(X’cafebabe
• Database error looking up cardID: VALUES CAST(‘
• DB URL: jdbc:no:x DB Driver: <5-char random name>

Files written to disk:

• <install>serverlib<5-char-name>.class
• <install>serverdatacontent<5-char-name>.cmd
• <install>serverdatacontent<5-char-name>.out

Affected versions

The vulnerability affects all versions of PaperCut NG and MF.

Mitigation

The vendor has released an updated Emergency Patch (Release 2) for v24, v25, and v26, including additional hardening to patch the vulnerabilities.

For more information, please refer to the PaperCut Advisory.

Qualys Detection

Qualys customers can scan their devices with QID 388533 to detect vulnerable assets.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

References
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/