> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# PaperCut NG/MF Critical Zero-Day Exploited in the Wild
- URL: https://f4n6.co.uk/security-feed/papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
- Published: 2026-08-28T12:07:49.000Z
- Updated: 2026-08-28T12:07:49.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

PaperCut Software has confirmed active in-the-wild exploitation of a zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF. The vulnerability is an authentication bypass in the Apache Tapestry-based web application server that enables unauthenticated attackers to reconfigure external database lookup settings and chain malicious SQL execution via Apache Derby and H2 database drivers, culminating in remote code execution (RCE). On August 28, 2026, the vendor assigned CVE-2026-81578 and CVE-2026-82078 for the two vulnerabilities comprising the exploit chain, and released emergency patches for versions 25 and 26\. EMEA financial services organisations running internet-exposed PaperCut Application Servers are at immediate risk of unauthenticated RCE; the attack chain is trivially reproducible and follows mass exploitation of PaperCut CVE-2023-27350 by ransomware operators in 2023.

## 2\. Regulatory framing

| Article      | Trigger (the fact in this item)                                                                                                                                                                     | Practical impact                                                                                                                                                                                             |
| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| DORA Art. 19 | Confirmed active exploitation of a zero-day resulting in RCE on customer PaperCut servers — a potential major ICT-related incident if the compromised server is within an in-scope ICT environment. | Financial entities must assess whether exploitation constitutes a major ICT-related incident under their classification criteria and, if so, meet DORA Art. 19 reporting timelines to competent authorities. |
| DORA Art. 24 | The vulnerability requires emergency patching and immediate exposure assessment of PaperCut Application Servers, particularly internet-facing instances.                                            | Entities must incorporate this zero-day into their digital operational resilience testing programme and prioritise vulnerability remediation for critical/exposed components.                                |

## 3\. Technical analysis & attack chain

**Note on CVE assignment and severity:** The VERIFIED REFERENCE DATA supplied for this item resolved no CVE records, CVSS scores, or CISA-KEV exploitation states. The source material (Rapid7) states that on August 28 the vendor assigned CVE-2026-81578 and CVE-2026-82078 for the two vulnerabilities in the chain. No CVSS scores or CISA-KEV status have been confirmed in the verified data; treat any severity characterisation as vendor-reported, not independently validated. No threat actor attribution is present in the source material.

### Attack chain (confirmed from Rapid7 technical analysis)

1. **Initial access — authentication bypass via Apache Tapestry "complex direct" request format.** PaperCut uses the Apache Tapestry framework, whose "complex direct" request format allows specifying one page for display and a different page containing the component to execute. PaperCut validates access only on the displayed page. By selecting the public Error page (or Exception page) for display, an attacker bypasses authentication while invoking administrative components belonging to `ConfigEditor` or `UserList`.
2. **Unauthenticated configuration modification.** The attacker sends HTTP POST requests to the following URIs to access the configuration editor without authentication: - `/app?service=direct/1/Error/ConfigEditor/quickFindForm` \- `/app?service=direct/1/Error/ConfigEditor/$Form`

The path segment with value `1` can be any value. The `Error` path segment may also be `Exception`.

1. **External database lookup reconfiguration.** Using the ConfigEditor access, the attacker modifies four external user-lookup settings: - `user-lookup.db-driver` \- `user-lookup.db-url` \- `user-lookup.id-to-username-sql` \- `user-lookup.enabled`

These settings normally allow administrators to connect PaperCut to an external card database. The attacker configures them with a malicious JDBC connection URL and a malicious SQL statement.

1. **SQL execution via Derby → H2 → Nashorn chain.** The attacker leverages PaperCut's bundled Apache Derby database driver and supplies a Derby `CALL` statement that activates Derby's `foreignViews` feature. This causes Derby to open an attacker-controlled H2 JDBC URL. H2 processes an inline `INIT` statement that creates a JavaScript-backed database trigger. PaperCut includes the Nashorn JavaScript engine, allowing that trigger to start an operating-system process. The source notes that other command execution mechanisms beyond Nashorn are also expected to be viable.
2. **Triggering execution.** The attacker submits a search through the forged UserList request: - `/app?service=direct/1/Error/UserList/$QuickFind.$Form`

This activates the external lookup and executes the malicious SQL, completing the RCE chain.

**Affected versions:** All versions of PaperCut NG and PaperCut MF are considered potentially impacted by the vendor. Emergency patches are available for versions 25 and 26 only. An emergency patch for version 24 is in development. Versions earlier than 24 have no patch available at time of writing.

**Historical context:** PaperCut CVE-2023-27350 was broadly exploited in the wild in 2023 by multiple threat-actor groups including ransomware operators. This history elevates the urgency of the current zero-day.

**Confidence caveat:** The full technical attack chain is single-sourced (Rapid7 blog post). The vulnerability disclosure and emergency patch availability are corroborated by The Hacker News, SecurityWeek, The Register, and Help Net Security. No named threat actor attribution is present in any source; any attribution is unconfirmed.

## 4\. Mitigation & containment

### P1 — within 24 hours

- **Restrict web access immediately.** Block all untrusted internet hosts from reaching PaperCut web interfaces. Implement firewall rules, network access control rules, or reverse-proxy restrictions to limit access to trusted internal corporate IP ranges only. This is the vendor's primary recommendation and breaks the attack chain at the initial access vector.
- **Identify all PaperCut NG/MF deployments** across the estate, including those managed by individual business units or at branch sites. Prioritise any instance with a public-facing Application Server.
- **Apply emergency patches** for PaperCut NG/MF versions 25 and 26 where the server cannot be fully restricted from untrusted access. Note: the vendor states these builds have not undergone their normal release process and are intended as emergency fixes for public-facing servers that cannot otherwise mitigate exposure.

### P2 — within 72 hours

- **Hunt for compromise** on all PaperCut Application Servers, especially those that were or are internet-exposed. Review:
- PaperCut `server.log` for the entries listed in §5.
- Integrity of `server.log` files — missing, truncated, or deleted logs are a potential indicator.
- EDR/endpoint alerts for suspicious post-exploitation activity associated with `pc-app.exe`.
- IDS/IPS and network monitoring alerts involving the PaperCut Application Server.
- **For version 24 deployments:** monitor for the vendor's emergency patch release. Until it is available, ensure strict network-level access restrictions are in place and verified.
- **For versions earlier than 24:** contact PaperCut support for guidance. No patch is available. These versions should be isolated from all untrusted network access immediately and migration to a supported version planned.

### P3 — within 7 days

- **Validate patch deployment** and confirm PaperCut Application Servers are no longer reachable from untrusted networks.
- **Conduct retrospective forensic review** of internet-exposed PaperCut servers for the period from August 27, 2026 backward to the earliest plausible exploitation date, given that the vulnerability was discovered via a customer incident.
- **Review whether the PaperCut Application Server needs to be internet-facing at all.** If not, permanently remove external exposure.
- **Run authenticated vulnerability scans** using Rapid7 InsightVM/Nexpose (authenticated check expected in August 28 content release) or equivalent tooling to confirm remediation.

## 5\. Indicators of compromise

The following indicators are derived from the PaperCut vendor advisory as reported by Rapid7\. PaperCut has not yet published validated network-based indicators such as malicious IP addresses, domains, or URLs. The vendor explicitly warns that the absence of indicators should not be interpreted as evidence that a system has not been affected.

| Type          | Value                                                                 | Confidence | Source                     |
| ------------- | --------------------------------------------------------------------- | ---------- | -------------------------- |
| Log entry     | ERROR No suitable driver found for jdbc:no:x                          | Medium     | Rapid7 / PaperCut advisory |
| Log entry     | ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST   | Medium     | Rapid7 / PaperCut advisory |
| Process       | Suspicious post-exploitation activity associated with pc-app.exe      | Medium     | Rapid7 / PaperCut advisory |
| Log integrity | Missing, unexpectedly truncated, or deleted PaperCut server.log files | Medium     | Rapid7 / PaperCut advisory |

### Behavioural indicators

| Behaviour                                                                                                                                                                | Where to observe                                                      | Confidence |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------- | ---------- |
| HTTP POST requests to /app?service=direct/\*/Error/ConfigEditor/\* or /app?service=direct/\*/Exception/ConfigEditor/\* from unauthenticated sessions                     | PaperCut Application Server access logs, WAF logs, reverse proxy logs | High       |
| HTTP POST requests to /app?service=direct/\*/Error/UserList/$QuickFind.$Form or /app?service=direct/\*/Exception/UserList/$QuickFind.$Form from unauthenticated sessions | PaperCut Application Server access logs, WAF logs, reverse proxy logs | High       |
| Modification of user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql, or user-lookup.enabled configuration settings                                 | PaperCut server.log, configuration file integrity monitoring          | High       |
| Outbound JDBC connections from PaperCut Application Server to attacker-controlled database URLs                                                                          | Network firewall logs, egress proxy logs, EDR network telemetry       | Medium     |

No atomic network indicators (IPs, domains, URLs) are available in the source material. The copyable IOC block is omitted as no machine-pivotable atomic indicators have been published.

## 6\. Detection

```yara
rule PaperCut_ZeroDay_Aug2026_Exploit_Artifacts {
    meta:
        author = "Adverse Trace"
        date = "2026-08-28"
        reference = "https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild"
        description = "Detects PaperCut NG/MF zero-day exploit chain artefacts in server logs and HTTP traffic"
    strings:
        $uri_config_quickfind = "service=direct/1/Error/ConfigEditor/quickFindForm" ascii
        $uri_config_form = "service=direct/1/Error/ConfigEditor/$Form" ascii
        $uri_userlist = "service=direct/1/Error/UserList/$QuickFind.$Form" ascii
        $uri_exception_config = "service=direct/1/Exception/ConfigEditor/" ascii
        $uri_exception_userlist = "service=direct/1/Exception/UserList/" ascii
        $setting_driver = "user-lookup.db-driver" ascii
        $setting_url = "user-lookup.db-url" ascii
        $setting_sql = "user-lookup.id-to-username-sql" ascii
        $setting_enabled = "user-lookup.enabled" ascii
        $log_nodriver = "ERROR No suitable driver found for jdbc:no:x" ascii
        $log_dberror = "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST" ascii
    condition:
        3 of them
}

```

```yaml
title: PaperCut NG/MF Unauthenticated ConfigEditor or UserList Access via Tapestry Direct Request
id: AT-2026-08-28-677-sigma-1
status: experimental
description: Detects HTTP POST requests to PaperCut Application Server exploiting Apache Tapestry complex direct request format to bypass authentication and access ConfigEditor or UserList components
author: Adverse Trace
date: 2026/08/28
references:

    - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        c-uri|contains:

            - 'service=direct/'
            - '/Error/ConfigEditor/'
            - '/Exception/ConfigEditor/'
            - '/Error/UserList/'
            - '/Exception/UserList/'
    selection_method:
        cs-method: POST
    filter_authenticated:
        sc-status:

            - 401
            - 403
    condition: selection_uri and selection_method and not filter_authenticated
falsepositives:

    - Legitimate administrator access to PaperCut ConfigEditor or UserList from authenticated sessions (verify session/authentication context)
level: high

```

```yaml
title: PaperCut server.log Indicators of Zero-Day Exploitation
id: AT-2026-08-28-677-sigma-2
status: experimental
description: Detects known PaperCut server.log error entries associated with exploitation of the August 2026 zero-day
author: Adverse Trace
date: 2026/08/28
references:

    - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
logsource:
    category: application
    product: papercut
detection:
    selection:
        message|contains:

            - 'No suitable driver found for jdbc:no:x'
            - 'DatabaseUtils - Database error looking up cardID: VALUES CAST'
    condition: selection
falsepositives:

    - Misconfigured external database lookup in legitimate administration (verify against change records)
level: high

```

## 7\. Sources

- Rapid7 — "PaperCut NG/MF Critical Zero-Day Exploited in the Wild" — https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild — 2026-08-28
- The Hacker News — "PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions" — https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html — 2026-08-28
- SecurityWeek — "PaperCut Releases Emergency Patch for Exploited Zero-Day" — https://www.securityweek.com/papercut-releases-emergency-patch-for-exploited-zero-day/ — 2026-08-28
- The Register — "Print management outfit PaperCut is under 0-day attack, and it's drawing customers' blood" — https://www.theregister.com/security/2026/08/28/print-management-outfit-papercut-is-under-0-day-attack-and-its-drawing-customers-blood/5293168 — 2026-08-28
- Help Net Security — "Unknown PaperCut NG/MF vulnerability is under active attack" — https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/ — 2026-08-27

## 8\. Adverse Trace position

This is a critical unauthenticated RCE chain in widely deployed enterprise print management software, with confirmed active exploitation and a proven historical precedent for ransomware operator interest (CVE-2023-27350 in 2023). The technical chain — Apache Tapestry authentication bypass → ConfigEditor manipulation → Derby foreignViews → H2 INIT → Nashorn RCE — is well-documented and reproducible. No CVSS score or CISA-KEV listing has been confirmed in verified reference data; CVE-2026-81578 and CVE-2026-82078 are reported by the source but not yet independently validated. The full technical mechanism is single-sourced (Rapid7); the exploitation and patch availability are multi-source corroborated. EMEA financial services clients should treat any internet-exposed PaperCut Application Server as presumptively compromised, restrict access immediately, apply emergency patches for versions 25/26, and conduct forensic review. Adverse Trace will monitor for CVE/CVSS confirmation, CISA-KEV addition, version 24 patch availability, and any emerging IOCs or actor attribution.

---

[Read the original source →](https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*