Actively Exploited PaperCut Flaws Enable Pre-Authentication SYSTEM RCE
Active Exploitation · 4 sources · Updated 2mo ago · First seen Sep 14, 2026
Attackers are exploiting two vulnerabilities in PaperCut NG and PaperCut MF—CVE-2026-81578, an authentication-bypass flaw, and CVE-2026-82078, an unsafe dynamic class-loading issue. Chained together, the flaws can permit unauthenticated configuration changes and remote code execution as SYSTEM on PaperCut Application Servers, creating opportunities for credential theft, persistence, and potential Active Directory compromise. Campaigns have reportedly targeted educational organizations in the United States and Europe, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
PaperCut issued emergency releases for supported branches, including versions 24.1.10, 25.0.13, and 26.0.5, followed by tested maintenance releases. The third emergency patch added protections and addressed SAML authentication and legacy Microsoft SQL Server driver issues after Rapid7 identified that the initial patch could be bypassed. Organizations should deploy the current maintenance versions, validate patched integrations, review logs and indicators of compromise for pre-patch activity, and rebuild affected application servers where compromise is suspected; 23.x and earlier versions reportedly lacked a patch at the time of reporting.
