PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

1. Executive summary

PaperCut NG and PaperCut MF are under active exploitation via a pre-authentication remote code execution (RCE) chain comprising two vulnerabilities: CVE-2026-81578 (improper access control in the web management interface) and CVE-2026-82078 (unsafe dynamic class-loading in database connection utilities). No verified CVSS scores, severity ratings, or CISA-KEV exploitation states were available in the reference data for these CVEs at time of writing. Huntress confirmed exploitation in two customer environments and reproduced the full chain against a stock installation of PaperCut NG 25.0.11.75758. EMEA financial services running PaperCut with internet-exposed web management interfaces face immediate risk of unauthenticated server takeover; the Application Server process runs with elevated privileges and can execute arbitrary Java bytecode.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item beyond the baseline incident-management and reporting obligations that apply to any actively exploited vulnerability. The vulnerability is in on-premises print management software; unless PaperCut is delivered as a managed ICT third-party service, the supply-chain articles are not specifically triggered by a distinctive fact in this item.

3. Technical analysis & attack chain

Affected products: PaperCut NG and PaperCut MF. PaperCut treats all versions as potentially affected. Emergency patches are available for versions 25 and 26; version 24 fixes are still in progress.

Vulnerable version confirmed by Huntress: PaperCut NG 25.0.11.75758 (stock installation, full chain reproduced).

Patched builds (version 25, Windows)

• PaperCut NG: 25.0.12.76497
• PaperCut MF: 25.0.12.76496

A second emergency patch ("Release 2") has also been released; organisations that installed the original emergency patch should install Release 2 as well.

CVE assignments

Attack chain (confirmed by Huntress reproduction and incident response)

1. Initial access — crafted request to web management interface. An unauthenticated attacker sends a specifically crafted HTTP request to the PaperCut web management interface. The request refers to one page that is rendered for the response and a different page that owns the component or action being executed. PaperCut's authorisation check trusts the rendered page and does not evaluate the permissions required by the component behind it (CVE-2026-81578).
2. Configuration modification. The authorisation bypass grants access to sensitive endpoints that can trigger unsafe actions, allowing the attacker to modify server configuration.
3. Arbitrary code execution via dynamic class-loading. The attacker leverages the modified configuration to reach the database connection utilities, which contain an unsafe dynamic class-loading mechanism (CVE-2026-82078). A hex-encoded Java .class file is delivered through this pathway and loaded as arbitrary Java bytecode inside the PaperCut Application Server process.
4. Post-exploitation — reconnaissance commands. In the two observed customer incidents, the threat actor executed base64-encoded commands. The string d2hvYW1pICYgdmVy was found multiple times in server.log; it decodes to whoami & ver, which identifies the user account and Windows operating system version. The observed exploitation activity in one incident lasted under two minutes.

Confidence caveat

All technical detail in this section is single-sourced from the Huntress blog post. No second vendor or advisory has independently corroborated the exploitation mechanism or the post-exploitation behaviour at time of writing. Verify before enforcement where possible.

Attribution

No named threat actor is identified in the source material. Attribution is unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

• Remove public exposure immediately. The PaperCut web management interface must not be reachable from the internet. Restrict access to the Application Server port to internal/trusted networks only. If remote access is required, force it through a VPN or jump host with MFA.
• Apply the emergency patch. Upgrade PaperCut NG/MF to the emergency patched builds:
• PaperCut NG 25.x → 25.0.12.76497
• PaperCut MF 25.x → 25.0.12.76496
• If running version 26, follow PaperCut's advisory for the corresponding emergency build.
• If the original emergency patch was already installed, install Release 2 as well.
• Version 24 and earlier: No fix is available yet. If patching to 25/26 is not immediately feasible, isolate the PaperCut Application Server from all untrusted network access as an interim control.

P2 — within 72 hours

• Review server.log for exploitation artefacts. Search for the base64 string d2hvYW1pICYgdmVy and any hex-encoded Java .class file content. These are the confirmed indicators of the observed exploitation.
• Audit configuration changes. Review the PaperCut Application Server configuration for unauthorised modifications made via the access-control bypass. Pay particular attention to database connection settings, which are the pathway to the class-loading vulnerability.
• Hunt for post-exploitation. On any PaperCut server that was internet-exposed on or before 27 August 2026, investigate for evidence of command execution (whoami, ver), unexpected child processes of the PaperCut Application Server, and outbound network connections that may indicate further staging.

P3 — within 7 days

• Validate patch deployment across all PaperCut NG and MF instances, including secondary sites and DR environments.
• Implement network segmentation so that PaperCut Application Servers communicate only with print devices, directory services, and administrative workstations — not with the general corporate network or internet.
• Confirm version 24 remediation once PaperCut releases the fix; until then, maintain isolation.

5. Indicators of compromise

base64  d2hvYW1pICYgdmVy
command  whoami & ver

Note: The hex-encoded Java .class file content was referenced in the source but the full hex string was not published in the available material. Do not treat the absence as a negative — the source text was truncated. If the full Huntress blog is accessible, extract the hex string and add it to the IOC block.

6. Detection

The source material provides a specific base64 string observed in PaperCut server.log and a decoded command pair. These are genuine threat artefacts suitable for log-based detection.

title: PaperCut Pre-Auth RCE - Base64 Command Execution in server.log
id: 7a3c1f2e-2026-0828-papercut-rce
status: experimental
description: >
  Detects base64-encoded reconnaissance commands observed during active
  exploitation of PaperCut NG/MF CVE-2026-81578 / CVE-2026-82078 chain.
  The string d2hvYW1pICYgdmVy decodes to "whoami & ver".
author: Adverse Trace
date: 2026/08/28
references:

  - https://www.huntress.com/blog/papercut-actively-exploited
logsource:
  product: papercut
  service: server_log
detection:
  selection_b64_string:
    message|contains:

      - "d2hvYW1pICYgdmVy"
  selection_decoded_command:
    message|contains:

      - "whoami & ver"
  condition: selection_b64_string or selection_decoded_command
falsepositives:

  - Legitimate administrative scripts using the same base64 string (unlikely)
level: high

No YARA rule is emitted. The source references a hex-encoded Java .class file but does not publish the hex string or file hash; without those artefacts, a YARA rule cannot be constructed from threat-specific strings.

7. Sources

• Huntress, "PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE," https://www.huntress.com/blog/papercut-actively-exploited, published 2026-08-28 (updated 2026-08-28T18:45:00Z).

8. Adverse Trace position

This is a confirmed, actively exploited pre-authentication RCE chain in widely deployed print management software. The attack requires no credentials and grants arbitrary code execution within the PaperCut Application Server process. No CVSS scores, severity ratings, or CISA-KEV states were available in the verified reference data; we are not re-assessing severity from the source text. All technical detail is single-sourced from Huntress — verify before enforcement where feasible. EMEA financial services should treat any internet-exposed PaperCut instance as potentially compromised and prioritise the P1 actions above immediately. We will update this advisory when additional vendor advisories, CVSS scores, KEV additions, or corroborating sources become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.