Attackers Chain Two PaperCut Flaws for Unauthenticated Remote Code Execution

Malicious actors are actively exploiting two newly disclosed vulnerabilities in PaperCut NG and PaperCut MF to achieve remote code execution without authentication, prompting the Australian vendor to release a second emergency patch this week. The flaws are being chained together: CVE-2026-81578 allows attackers to bypass authentication on the web management interface, which then enables exploitation of CVE-2026-82078—an unsafe dynamic class loading vulnerability (CVSS 9.4)—to instantiate arbitrary Java classes and run code inside the PaperCut process.

Huntress researchers John Hammond and Andrew Brandt detailed how the attack works: a specially crafted unauthenticated request can reference one page for the rendered response while triggering a different page's underlying component. PaperCut's authorization logic trusts the rendered page and overlooks the permissions required by the executed component, granting access to sensitive configuration endpoints. With configuration control established, attackers leverage the database driver loading flaw to load malicious classes without any allowlist validation. "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," explained Jake Knott, head of threat at watchTowr.

PaperCut has issued a second emergency fix containing "additional hardening beyond the original emergency patch," though specifics on in-the-wild activity remain limited. Hammond told The Hacker News that observed activity appears consistent with early-stage reconnaissance, including commands to enumerate victim user accounts and operating systems. "At this time, we don't have enough evidence to determine the threat actors' ultimate end goal," he noted.

Administrators are urged to patch immediately and audit their PaperCut instances for signs of compromise. Security teams should verify management interface exposure using a port scanner, validate transport-layer protections with an SSL/TLS checker, and confirm that administrator credentials have not appeared in prior exposures via an email breach checker—rotating any reused passwords without delay.