Listen to this Post
A Quiet Attack That Could Become Something Much Worse
Print servers rarely attract the same attention as internet-facing firewalls, VPN appliances, or cloud platforms. Yet they sit deep inside corporate networks, schools, hospitals, universities, and government environments, often with powerful privileges and access to sensitive infrastructure.
That makes the newly exploited PaperCut vulnerability especially concerning.
A critical pre-authentication remote code execution flaw in PaperCut NG can allow an attacker to execute commands on a vulnerable server without first logging in. Security researchers at Huntress have confirmed exploitation against real organizations and independently reproduced the complete attack chain on a clean, unpatched installation.
The attacks observed so far were surprisingly limited. Investigators saw commands such as whoami, ver, and tasklist, apparently used to identify the compromised machine and its environment. No secondary malware, persistent backdoor, or obvious command-and-control infrastructure was observed.
But that relative restraint should not be mistaken for safety.
The technical chain gives attackers something far more valuable than simple reconnaissance: unauthenticated code execution with SYSTEM-level privileges on Windows.
What Happened to PaperCut?
A Vulnerability With Real-World Exploitation
PaperCut confirmed that CVE-2026-81578 is being actively exploited against customers. Huntress identified evidence of attacks in two separate customer environments and then reproduced the exploitation process independently.
This is an important distinction.
The vulnerability is not merely theoretical, and defenders are not dealing with a proof-of-concept that exists only in a researcher’s laboratory. Attackers have already demonstrated that vulnerable PaperCut installations can be reached and manipulated in real environments.
The First Bug: An Authorization Failure
When the Server Checks the Wrong Thing
The initial vulnerability is rooted in an authorization mistake.
An attacker can construct a specially crafted request that causes PaperCut to display one page while actually executing an action associated with another page.
The security check is therefore performed against the wrong operation.
Instead of verifying whether the attacker is authorized to perform the action actually being executed, PaperCut can effectively validate permissions against the page being presented.
That creates an opportunity to perform privileged configuration changes without authentication.
The Second Bug Turns Access Into Code Execution
CVE-2026-82078 Completes the Attack Chain
The first vulnerability becomes significantly more dangerous when combined with CVE-2026-82078.
This second weakness affects
Once the attacker reaches this stage, the consequences change dramatically.
The attacker is no longer simply modifying configuration. The vulnerable Java functionality can be abused to execute arbitrary Java code on the server.
Together, the two flaws form a powerful attack chain:
Unauthenticated request → authorization bypass → configuration manipulation → unsafe Java class loading → arbitrary code execution
That is the kind of chain defenders should treat as a potential full server compromise.
Huntress Recreated the Attack
Researchers Built the Exploit From Scratch
Huntress did not stop at observing suspicious activity.
Researchers reproduced the complete pre-authentication RCE chain against a clean PaperCut NG 25.0.11.75758 installation.
Their testing demonstrated that a remote attacker could trigger code execution without providing valid credentials.
This provides particularly strong evidence of the
SYSTEM Privileges Make the Situation Worse
The Highest Windows Privilege Level
During testing, Huntress observed the PaperCut pc-app.exe Application Server launching charmap.exe with SYSTEM privileges.
That detail matters enormously.
Windows SYSTEM privileges provide an attacker with extremely broad control over the operating system. If an attacker can reliably turn an unauthenticated network request into SYSTEM-level execution, the PaperCut server effectively becomes a potential foothold inside the organization’s infrastructure.
From there, the attacker could potentially investigate the environment, access credentials, move laterally, disable security controls, deploy malware, or establish persistence.
The fact that those additional actions were not observed in these incidents does not mean the vulnerability cannot support them.
The Attacks Were Surprisingly Quiet
Two Minutes Was Enough for Reconnaissance
The real-world incidents investigated by Huntress were remarkably restrained.
One attack lasted less than two minutes and involved commands such as:
whoami ver
These are basic reconnaissance commands.
whoami reveals the account under which the process is executing, while ver identifies the Windows version.
A second incident went slightly further with:
tasklist
This allows an attacker to inspect running processes.
No secondary malware was discovered.
No additional command-and-control traffic was observed.
No obvious persistence mechanism was identified.
And there was no evidence of a larger post-exploitation campaign in the investigated cases.
Quiet Reconnaissance Can Be the Most Important Warning
The Absence of Malware Is Not Reassurance
There is a dangerous tendency in incident response to equate malware with compromise.
That assumption is increasingly unreliable.
An attacker who has obtained remote code execution does not necessarily need to immediately install ransomware or deploy a persistent backdoor.
They may first determine:
Who am I?
What operating system is this?
What processes are running?
Is this server interesting?
Is it connected to other systems?
Can I return later?
Are security products installed?
Does this machine provide access to a larger network?
The activity observed by Huntress looks much more like reconnaissance than the final stage of an attack.
That could mean the attackers were testing the vulnerability, mapping targets, or simply determining whether the compromised systems were worth pursuing.
The Forensic Evidence Is Particularly Valuable
Attackers Tried to Erase Their Tracks
The investigation uncovered a malicious Java .class file placed directly inside the PaperCut installation directory.
The malicious class was capable of executing commands and writing command output to a temporary file.
It then attempted to clean up after itself.
The payload deleted its own output file and attempted to remove PaperCut’s server.log.
That behavior is significant because it demonstrates that the attackers, or the exploit payload, were actively attempting to reduce forensic visibility.
One Breadcrumb Survived
The Derby Database Log Became the Clue
Despite the cleanup attempt, investigators discovered another artifact that remained behind.
The PaperCut Derby database log contained a suspicious entry referencing:
jdbc:derby:memory:pwn
The unusual pwn database directory is particularly valuable because it provides defenders with a high-confidence indicator that the exploitation chain may have been executed.
This illustrates an important principle of modern incident response: attackers can delete files, clear logs, and remove temporary artifacts, but they rarely control every telemetry source available to defenders.
PaperCut’s Emergency Patching Became Complicated
The First Fix Was Not the End of the Story
PaperCut released an emergency patch after the vulnerability came to light.
However, less than 24 hours later, the company issued another update following additional testing.
That rapid revision demonstrates how difficult emergency vulnerability response can become when researchers and vendors are still determining the full scope of an exploit chain.
The situation was even more complicated for version 24, where fixes were still being developed when Huntress published its findings.
Older Versions Are the Biggest Problem
Almost Half of Tracked Installations Were Behind
Huntress found that approximately 47% of the roughly 2,500 PaperCut installations it monitors were running version 23 or earlier.
At the time of the report, those older versions did not have an available patch.
This creates a particularly uncomfortable situation for organizations that have delayed upgrades.
A vulnerability is dangerous.
An actively exploited vulnerability is more dangerous.
An actively exploited vulnerability affecting software that is difficult to upgrade becomes an operational emergency.
Why Print Servers Matter More Than Organizations Think
The Printer Is Not the Real Target
PaperCut is often viewed as infrastructure surrounding printers.
That can lead organizations to underestimate the importance of the software.
The server running the print-management platform, however, is still a computer connected to the organization’s network.
It may have:
Domain connectivity
Administrative privileges
Network access
Stored configuration information
Credentials or service accounts
Access to internal systems
Visibility into users and devices
Connections to file servers and databases
Consequently, compromising the print-management server can potentially provide an attacker with a strategic position inside the network.
CISA Adds Pressure on Federal Agencies
September 14 Becomes the Critical Deadline
The vulnerabilities have been included in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.
Under Binding Operational Directive 22-01, federal civilian agencies are required to remediate vulnerabilities listed in the KEV catalog within the prescribed deadlines.
For these PaperCut vulnerabilities, federal agencies face a remediation deadline of September 14.
The broader message extends beyond government networks.
Private organizations should also treat KEV-listed vulnerabilities as high-priority remediation targets because inclusion indicates that exploitation has moved beyond theoretical risk.
Deep Analysis
Understanding the Exploit Chain
The most important technical lesson is that CVE-2026-81578 should not be evaluated in isolation.
The authorization flaw provides the initial foothold.
CVE-2026-82078 then helps transform that foothold into arbitrary Java execution.
This is a classic vulnerability-chain scenario where two individually serious weaknesses become significantly more dangerous when combined.
Check Your PaperCut Version
Windows Command
Administrators can begin by identifying the installed PaperCut service and installation directories.
For example:
sc query type= service | findstr /I "PaperCut"
You can also inspect common installation paths:
dir "C:\Program Files\PaperCut" /s /b
The exact installation location can vary between environments, so administrators should not assume that every deployment uses the same path.
Look for Suspicious Java Class Files
Investigate the PaperCut Directory
Security teams should review the PaperCut installation directory for unexpected .class files.
A PowerShell search can help identify recently modified Java class files:
Get-ChildItem "C:\Program Files\PaperCut" -Recurse -Filter .class | Sort-Object LastWriteTime -Descending | Select-Object FullName, LastWriteTime
Unexpected files should be investigated rather than automatically deleted.
Preserving evidence before remediation can be critical for determining whether exploitation occurred.
Search for the High-Confidence Indicator
Look for jdbc:derby:memory:pwn
Administrators investigating possible exploitation should search
Get-ChildItem "C:\Program Files\PaperCut" -Recurse -Filter derby.log | Select-String -Pattern "jdbc:derby:memory:pwn"
A match should be treated as a serious investigation trigger.
It should not be dismissed as harmless noise without understanding how and when the entry was created.
Investigate Process Creation
Look for Unusual Child Processes
Because the exploit chain can result in the PaperCut application server launching Windows processes, defenders should examine endpoint telemetry for unusual process relationships.
A useful PowerShell query for basic local investigation is:
Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, Name, CommandLine |
Sort-Object ParentProcessId
Security products with process-tree telemetry are even more valuable because they can reveal exactly which process created which child process.
Search for Reconnaissance Commands
whoami, ver, and tasklist
Organizations with centralized Windows event collection should search for suspicious execution of commands such as:
whoami ver tasklist
The commands themselves are not malicious.
That distinction is important.
An administrator running whoami is completely normal. A PaperCut server unexpectedly launching these commands immediately after suspicious network activity is a very different story.
Context matters more than the command alone.
Investigate Deleted Logs
Missing Evidence Can Be Evidence
Huntress observed an exploit payload that attempted to delete server.log.
Therefore, organizations should not only search existing logs.
They should also ask whether expected logs suddenly disappeared, became unusually small, or show gaps around the suspected exploitation period.
Unexpected logging gaps around suspicious process execution can be an important forensic signal.
Check Network Connections
Look Beyond the PaperCut Server
If compromise is suspected, investigate outbound connections from the PaperCut server.
On Windows, administrators can inspect current TCP connections with:
netstat -ano
PowerShell provides another option:
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
These commands provide only a snapshot, so historical EDR, firewall, proxy, and network telemetry should be examined whenever available.
Do Not Assume a Clean Payload Means a Clean Server
Reconnaissance Could Be Stage One
The most important investigative mistake would be concluding that the system is safe simply because no ransomware or persistent malware was found.
An attacker could have performed reconnaissance and left.
Another attacker could exploit the same vulnerability later.
Or the original attacker could return after determining that the server has useful access.
Therefore, organizations should treat confirmed exploitation as a security incident, not merely as an unsuccessful malware attempt.
Patch First, Then Investigate
Remediation and Forensics Must Work Together
If a vulnerable server is exposed and exploitation is suspected, organizations should prioritize containment and remediation while preserving relevant forensic evidence.
The correct sequence depends on the
In high-value environments, immediately wiping the machine can destroy evidence needed to determine how far an attacker progressed.
At the same time, leaving an actively exploitable server exposed while an investigation continues can create additional risk.
This is why coordinated incident response matters.
Segment Critical Print Infrastructure
Reduce the Blast Radius
Organizations should consider whether print-management servers really need unrestricted access to every part of the corporate network.
Network segmentation can dramatically reduce the impact of a successful server compromise.
A print server should ideally have only the network access required for its legitimate functions.
Restricting unnecessary outbound and lateral traffic can make post-exploitation much harder.
What Undercode Say:
- The Quiet Attacks Are the Real Warning
The most interesting part of this incident is not the exploit itself.
It is what the attackers did after obtaining execution.
They ran basic discovery commands instead of immediately deploying malware.
That behavior suggests that at least some attackers are using the vulnerability as an initial access mechanism rather than treating it as an opportunity for immediate destruction.
- Attackers Do Not Need Ransomware to Cause Damage
A compromised PaperCut server can become an intelligence source.
Attackers can learn about users, systems, processes, privileges, and network relationships.
That information can later support a much larger intrusion.
3. SYSTEM Execution Changes the Risk Calculation
Running code remotely is already serious.
Running that code with Windows SYSTEM privileges is substantially worse.
It potentially gives attackers control over the entire operating system rather than a limited application account.
4. The Two-Vulnerability Chain Matters
Defenders should not think about CVE-2026-81578 as an isolated authorization bug.
The second vulnerability demonstrates why vulnerability chaining remains one of the most powerful techniques available to attackers.
5. Emergency Patches Can Evolve Quickly
The rapid sequence of PaperCut updates demonstrates why organizations should monitor vendor advisories after applying an emergency fix.
The first patch is not always the final word.
6. Version 24 Deserves Special Attention
The reported exploitation of a version 24 server is particularly important because patch availability for that branch was still developing.
Organizations should not assume that owning a relatively recent version automatically means they are protected.
- Version 23 and Earlier Create a Major Exposure
If nearly half of the installations tracked by Huntress were still running version 23 or earlier, there is a substantial population potentially facing upgrade or mitigation challenges.
That makes inventory management just as important as patch management.
8. Internet Exposure Should Be Reconsidered
A print-management server generally does not need to be directly accessible from the public internet.
If a PaperCut deployment is externally exposed, administrators should immediately review whether that exposure is genuinely necessary.
- Exploitation Evidence Is More Valuable Than CVSS Alone
A theoretical critical vulnerability might remain unexploited for months.
This case is different.
Researchers have confirmed exploitation.
That changes the operational priority dramatically.
10. KEV Inclusion Should Trigger Action
The Known Exploited Vulnerabilities catalog exists specifically to help organizations prioritize vulnerabilities that attackers are actively using.
A KEV entry should not become another item sitting indefinitely in a vulnerability-management dashboard.
11. Security Teams Need Better Cross-Log Correlation
The surviving Derby artifact is a good example of why defenders need visibility across multiple logging systems.
Deleting one application log does not necessarily erase every trace.
12. Process Trees Can Tell the Story
A suspicious child process launched by PaperCut can provide far more context than an isolated command-line event.
EDR process telemetry should therefore be part of the investigation.
13. Reconnaissance Commands Are Contextual Indicators
whoami is not malware.
tasklist is not malware.
ver is not malware.
But these commands executed unexpectedly by a vulnerable application server can become powerful indicators when correlated with exploitation evidence.
14. Attackers May Be Testing Defenses
Short attacks could represent vulnerability validation.
An attacker may be determining whether a target is exploitable before investing additional resources.
15. The Next Stage Could Be Worse
The lack of secondary malware in the observed incidents is encouraging.
It is not a guarantee of future safety.
Once exploit code becomes widely available, different threat actors can use the same weakness with completely different objectives.
16. Print Infrastructure Belongs in Security Assessments
Organizations frequently prioritize email, identity, VPN, cloud, and endpoint infrastructure.
Print management can be overlooked.
That needs to change.
17. Administrative Service Accounts Increase the Stakes
If PaperCut operates with elevated privileges or interacts with privileged infrastructure, compromise of the server could provide attackers with additional opportunities.
Organizations should review exactly what permissions their PaperCut services have.
18. Least Privilege Matters
A service should not possess more permissions than its job requires.
Reducing unnecessary privileges can limit the consequences of a successful exploit.
- Network Segmentation Is a Second Line of Defense
Patching should always come first when a fix exists.
But segmentation provides protection when patching is delayed, complicated, or unavailable.
20. Legacy Software Creates Security Debt
Older PaperCut installations illustrate a larger enterprise problem.
Organizations sometimes keep applications running for years because upgrading them could interrupt business operations.
That decision creates accumulated security debt.
21. Asset Inventory Is Critical
You cannot patch what you do not know you have.
Organizations should maintain an accurate inventory of PaperCut servers, versions, operating systems, internet exposure, and service accounts.
22. Vulnerability Scanning Is Not Enough
A vulnerability scanner may identify a vulnerable PaperCut version.
It may not tell you whether someone has already exploited it.
That requires endpoint, application, network, and forensic telemetry.
23. Confirmed Exploitation Requires Incident Thinking
When exploitation is confirmed, the question should shift from:
Have we patched it?
to:
Was our environment compromised?
Those are two different questions.
24. Evidence Preservation Matters
Deleting suspicious files immediately can remove the evidence needed to understand the attack.
Security teams should follow established incident-response procedures before destroying forensic artifacts.
25. Attackers Are Becoming More Selective
The observed behavior demonstrates that attackers do not always need noisy tools.
Simple commands can provide enough intelligence to decide whether a compromised system is valuable.
- The Exploit Is Dangerous Even Without Persistence
An attacker does not need a permanent backdoor to cause harm.
A single privileged session can be enough to steal credentials, alter configurations, or move into another system.
27. Emergency Updates Need Verification
Organizations should verify that the installed PaperCut version is actually the patched version recommended for their deployment branch.
Simply installing “the latest available update” without checking compatibility and advisory details can create confusion.
28. Security Teams Should Monitor Vendor Advisories
When a vulnerability is actively exploited, circumstances can change quickly.
Additional affected versions, indicators, mitigations, or revised patches may appear shortly after initial disclosure.
29. CISA Deadlines Are Useful Beyond Government
Private companies are not necessarily subject to federal civilian agency directives.
But the deadlines provide a useful benchmark for how urgently organizations should treat known exploited vulnerabilities.
30. Public-Facing Systems Deserve Immediate Attention
If PaperCut is reachable from outside the organization, the risk profile becomes considerably more serious.
Internet exposure dramatically increases the pool of potential attackers.
31. Internal Systems Can Still Be Dangerous
Even if PaperCut is not internet-facing, an attacker who already has access to the network may still exploit it.
Internal segmentation therefore remains important.
32. Security Monitoring Should Include Application Servers
Organizations often monitor workstations and domain controllers more aggressively than application servers.
PaperCut demonstrates why application servers also deserve detailed endpoint telemetry.
33. Small Artifacts Can Reveal Major Attacks
A strange database path such as jdbc:derby:memory:pwn might look meaningless during a normal investigation.
In the right context, it can become one of the strongest indicators of compromise.
34. Attackers Can Clean Up Imperfectly
Log deletion and temporary-file cleanup show that the attacker attempted to hide activity.
But complete forensic erasure is difficult.
- Defense in Depth Is the Real Lesson
Patching, segmentation, least privilege, EDR, centralized logging, vulnerability management, and incident response all contribute different layers of protection.
No single control is sufficient.
36. Legacy Versions Need a Different Strategy
When patches are unavailable for older versions, organizations may need temporary isolation, access restrictions, compensating controls, or accelerated migration.
Leaving the vulnerable system fully exposed is the worst option.
37. Ransomware Operators Could Take Notice
A reliable unauthenticated RCE affecting widely deployed enterprise software is exactly the kind of weakness that can attract financially motivated attackers.
Even if current incidents remain limited, the threat landscape can change rapidly.
38. Healthcare and Education Are Especially Sensitive
PaperCut’s broad deployment across schools, hospitals, and offices means the potential victim population is diverse.
Different organizations also have very different levels of security maturity.
- Patch Speed Can Become a Competitive Security Advantage
Organizations capable of rapidly identifying vulnerable systems and deploying emergency updates reduce the window in which attackers can exploit them.
Automation and accurate asset inventories become extremely valuable during events like this.
- The Biggest Mistake Would Be Waiting for a Bigger Attack
The absence of ransomware should not be interpreted as evidence that the threat is fading.
The strongest opportunity for defenders is to act while the observed attacks are still relatively limited.
✅ Active Exploitation Is Confirmed
The article correctly presents CVE-2026-81578 as an actively exploited PaperCut vulnerability, with Huntress reporting evidence from real customer environments. This elevates the issue beyond a theoretical security weakness.
✅ Huntress Reproduced the Exploit Chain
Huntress independently reproduced the pre-authentication exploitation chain against a clean PaperCut NG installation. This supports the claim that the vulnerability is practically exploitable rather than dependent on an unusual victim configuration.
✅ SYSTEM-Level Execution Was Demonstrated
The research demonstrated
✅ The Attacks Were Primarily Reconnaissance
The reported incidents involved commands including whoami, ver, and tasklist, with no observed secondary malware or additional command-and-control activity. However, this describes the investigated incidents and should not be interpreted as a guarantee that all exploitation will remain limited.
⚠️ Older Versions Remain a Major Concern
The reported 47% figure comes from the approximately 2,500 PaperCut installations monitored by Huntress. It should therefore be understood as Huntress’s observed sample, not a measurement of every PaperCut deployment worldwide.
✅ CISA KEV Inclusion Requires Urgent Attention
The inclusion of actively exploited vulnerabilities in
Prediction
(+1) Rapid Patching Will Accelerate
Organizations running supported PaperCut versions are likely to prioritize emergency updates rapidly as awareness of confirmed exploitation increases.
(+1) Security Vendors Will Add More Detection Rules
EDR, SIEM, and network-security vendors are likely to expand detection for suspicious PaperCut process execution, malicious Java artifacts, and exploitation indicators.
(+1) PaperCut Deployments Will Face More Security Scrutiny
Security teams that previously treated print-management infrastructure as low-risk are likely to begin reviewing its privileges, network exposure, segmentation, and monitoring.
(-1) Older PaperCut Installations Could Become Prime Targets
Unpatched legacy versions could become increasingly attractive to attackers if reliable exploitation becomes widely available and no direct security update exists for those branches.
(-1) Reconnaissance Could Evolve Into Larger Intrusions
The relatively quiet incidents reported so far may not remain quiet. As more threat actors acquire exploitation capability, the same initial access could potentially be used for credential theft, lateral movement, ransomware deployment, or espionage.
(+1) KEV-Based Prioritization Will Become More Important
This incident reinforces the value of prioritizing vulnerabilities based on real-world exploitation rather than relying solely on severity scores.
(-1) Vulnerable Internet-Facing Servers Face the Greatest Immediate Risk
Organizations that expose PaperCut servers unnecessarily could face substantially greater attack pressure because attackers can reach those systems without first gaining internal network access.
(+1) Segmentation Will Limit Future Damage
Organizations that combine fast patching with network segmentation and least-privilege service accounts will be better positioned to contain exploitation if a vulnerable application is compromised.
(+1) The Forensic Indicators Will Help Defenders
The surviving Derby log artifact and observed process behavior provide defenders with concrete investigation opportunities. These indicators can help organizations determine whether vulnerable servers were targeted before or after remediation.
The Bigger Security Lesson
A Printer Server Can Become an Attacker’s Front Door
The PaperCut incident is a reminder that attackers do not care whether defenders consider a system important.
They care about what that system can access.
A print-management server may look like ordinary office infrastructure, but a remotely exploitable vulnerability combined with privileged execution can turn it into a powerful foothold.
The attacks observed so far may have been small.
The vulnerability itself is not.
For organizations running PaperCut, the priority should be straightforward: identify affected installations, apply the appropriate security update or mitigation, investigate for evidence of exploitation, review privileged access, and restrict unnecessary network exposure.
Waiting to see whether attackers become more aggressive is a dangerous strategy.
The warning signs are already there.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
