Loading story…
Attackers are exploiting two vulnerabilities in PaperCut NG and PaperCut MF—CVE-2026-81578, an authentication-bypass flaw, and CVE-2026-82078, an unsafe dynamic class-loading issue. Chained together, the flaws can permit unauthenticated configuration changes and remote code execution as SYSTEM on PaperCut Application Servers, creating opportunities for credential theft, persistence, and potential Active Directory compromise. Campaigns have reportedly targeted educational organizations in the United States and Europe, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
PaperCut issued emergency releases for supported branches, including versions 24.1.10, 25.0.13, and 26.0.5, followed by tested maintenance releases. The third emergency patch added protections and addressed SAML authentication and legacy Microsoft SQL Server driver issues after Rapid7 identified that the initial patch could be bypassed. Organizations should deploy the current maintenance versions, validate patched integrations, review logs and indicators of compromise for pre-patch activity, and rebuild affected application servers where compromise is suspected; 23.x and earlier versions reportedly lacked a patch at the time of reporting.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
PaperCut released Emergency Patch Release 3, which fixed supported 24.x, 25.x, and 26.x branches in versions 24.1.10, 25.0.13, and 26.0.5. Customers using either of the earlier emergency patches were instructed to apply the third release; it also addressed SAML authentication and legacy Microsoft SQL Server driver issues.
CISA added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog.
PaperCut issued Emergency Patch Release 2 after the first emergency patch was bypassed. Rapid7 identified that the initial patch could be bypassed.
PaperCut disclosed active exploitation of vulnerabilities affecting PaperCut NG and MF and issued Emergency Patch Release 1. The chained flaws enabled authentication bypass, configuration changes, and code execution on the PaperCut application server.
Huntress first observed exploitation of the PaperCut vulnerability chain in customer environments, including activity associated with credential harvesting, persistence, and registry-hive extraction. Arctic Wolf also documented attacks against K-12 schools and universities in the United States and Europe.
PaperCut subsequently released fully tested maintenance versions to replace the emergency patch builds.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security agencies warned that multiple vulnerabilities in **PaperCut MF** and **PaperCut NG** can expose organizations to serious compromise, including the actively exploited flaw **`CVE-2023-27350`**. CISA previously reported that malicious actors were exploiting the vulnerability in the wild, allowing unauthenticated attackers to gain remote access to vulnerable PaperCut application servers and potentially execute code, making internet-exposed print management systems a high-risk target. A later security bulletin from HKCERT highlighted additional PaperCut vulnerabilities, reinforcing ongoing risk around the platform and the need for prompt remediation. Together, the advisories indicate that unpatched PaperCut deployments remain attractive entry points for attackers, with affected organizations urged to review vendor guidance, apply available updates, and assess exposed servers for signs of compromise.
Jun 29, 2026
PaperCut has confirmed active exploitation of an undisclosed zero-day affecting **all versions** of its PaperCut NG and MF print-management products. The attacks target publicly accessible PaperCut Application Servers, and the vendor has reported customer incidents but has not disclosed the flaw’s technical details, attacker attribution, post-compromise actions, or whether data was stolen. PaperCut released emergency patches for public-facing Application Servers and urged customers to immediately restrict the web interface to trusted IP addresses using firewall or network controls. Administrators should investigate alerts involving suspicious `pc-app.exe` activity, altered or missing `server.log` files, and anomalous log errors; however, PaperCut cautioned that the absence of these indicators does not confirm a system is uncompromised. The incident follows prior ransomware and state-linked exploitation of PaperCut flaws, including `CVE-2023-27350` and `CVE-2023-27351`.
Sep 3, 2026
PaperCut released a second emergency patch for **CVE-2026-81578** and **CVE-2026-82078**, two actively exploited zero-days that can be chained for pre-authentication remote code execution on Internet-exposed PaperCut NG and PaperCut MF servers. The release followed reports that attackers could bypass the initial fix; Huntress observed intrusions on 26 and 27 August in which threat actors rapidly deployed hex-encoded Java class files and conducted host reconnaissance. Supported PaperCut versions 24 through 26 have updates, while version 23 and earlier require a full upgrade. Basel-Stadt schools detected unauthorized attempts to access their printing system during the night of 3 September despite having promptly applied vendor updates for the late-August vulnerability. The Education Department disconnected the system as a precaution, disrupting printing for about one school day; limited service resumed Friday, while broader restoration was planned for 7 September. Authorities reported no evidence of data theft, notified relevant cantonal bodies, opened an independent investigation and filed a criminal complaint; rather than restore the prior environment, they will fully rebuild it to reduce the risk of undetected malware.
Sep 11, 2026