Listen to this Post
A Critical Warning for PaperCut NG and MF Administrators
Print management software rarely receives the same attention as operating systems, browsers, or firewalls. Yet in modern organizations, a print server can sit deep inside a trusted corporate network, communicate with multiple endpoints, manage sensitive documents, and operate with powerful system privileges. That makes a vulnerability in print-management infrastructure far more dangerous than its name might suggest.
That concern has now become very real for organizations running PaperCut NG and PaperCut MF. PaperCut has released a second emergency security update after researchers discovered that attackers could exploit two vulnerabilities in the software and, even more concerning, that some of the protections introduced in the first emergency patch could be bypassed.
The situation is particularly serious because the flaws are not merely theoretical. PaperCut has confirmed that the vulnerabilities have been actively exploited in the wild, while security researchers working with the company have reproduced the attacks and identified multiple ways to circumvent the original fixes.
The newly disclosed vulnerabilities are tracked as CVE-2026-81578 and CVE-2026-82078. When chained together, they can potentially allow an unauthenticated attacker to bypass authentication and achieve remote code execution on affected PaperCut servers.
For administrators, the message is simple: install Emergency Patch Release 2 even if the first emergency patch has already been applied.
What Happened With the First Emergency Patch?
PaperCut initially warned customers about attacks targeting vulnerable PaperCut NG and MF servers without immediately revealing the CVE identifiers or technical details.
That decision was deliberate.
During an active incident, security vendors sometimes delay technical disclosure to give customers time to deploy mitigations before attackers receive enough information to reproduce the vulnerability. PaperCut followed that approach while its security team investigated the attacks.
The first emergency patch was therefore released under unusual circumstances: customers knew their servers were being targeted, but they did not yet have the complete technical picture.
That situation changed after further investigation involving
The investigation uncovered additional weaknesses in the original remediation.
Two Vulnerabilities Are at the Center of the Attack
PaperCut has now identified two vulnerabilities that can be chained together to defeat authentication protections and ultimately execute code on vulnerable systems.
The first is CVE-2026-81578, an authentication bypass vulnerability with a CVSS score of 8.8.
The second is CVE-2026-82078, a critical unsafe dynamic class-loading vulnerability with a CVSS score of 9.4.
Individually, both issues deserve immediate attention. Together, they create a much more dangerous attack path.
CVE-2026-81578: Authentication Can Be Bypassed
The first vulnerability exists in the PaperCut NG/MF web management interface.
Under certain conditions, unauthenticated remote requests can target administrative functions before the application’s access-validation process has fully completed.
In practical terms, the security boundary between an external requester and privileged administrative functionality can be crossed.
This is precisely the kind of weakness attackers look for in internet-facing management applications.
Authentication is supposed to be the gatekeeper. If an attacker can make the server perform sensitive backend operations before that gatekeeper finishes its checks, the entire security model begins to collapse.
CVE-2026-82078: Dangerous Dynamic Class Loading
The second vulnerability is even more severe.
PaperCut’s database connection utilities dynamically load database driver classes based on configurable driver names. According to the advisory, those names were not adequately restricted to an approved allowlist.
That creates an opportunity for an attacker who can manipulate relevant system configuration parameters.
If successful, malicious Java bytecode located on the application’s classpath can potentially be loaded and executed under the security context of the PaperCut server process.
This is a classic example of why dynamic functionality can become dangerous when strong validation is missing.
A feature designed to provide flexibility for database connectivity can become an execution mechanism when attackers are able to influence what classes the application loads.
The Dangerous Combination: Authentication Bypass Plus Code Execution
The greatest concern is not simply that two vulnerabilities exist.
It is that they can be chained.
An attacker could potentially begin without valid credentials, exploit the authentication weakness to reach functionality that should require authorization, manipulate relevant configuration behavior, and then abuse the dynamic class-loading weakness to achieve code execution.
That transforms a web-interface vulnerability into a potential server compromise.
For an organization, successful exploitation could mean much more than gaining access to a printing application. A compromised application server could become a foothold for further activity inside the corporate environment.
watchTowr Discovered Patch Bypasses
The story became even more concerning when researchers at watchTowr analyzed the first emergency fix.
According to the research team, its analysts were able to reproduce the vulnerabilities and discover multiple patch bypasses.
They also identified another authentication-bypass issue during their investigation.
This is an important lesson for defenders.
A patch is not automatically the end of an incident simply because the vendor has released it.
Attackers and security researchers can examine the patch itself, understand what security assumption changed, and determine whether another path reaches the same vulnerable functionality.
That appears to be what happened here.
Emergency Patch Release 2 Is Now Available
PaperCut Strengthens the Original Fix
PaperCut has now issued Emergency Patch Release 2, incorporating additional hardening developed after deeper analysis with its internal security team, Huntress, and watchTowr.
The company is explicitly telling customers to install the second release even if they already installed Emergency Patch Release 1.
That distinction matters.
Administrators should not assume that applying the first emergency patch means the current threat has been addressed.
The second release exists specifically because the first remediation was found to be insufficient against additional attack paths.
Supported PaperCut Versions
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26.
The updated releases cover:
Windows
Linux
macOS
Organizations running version 23 or earlier should not simply wait for an equivalent patch. PaperCut recommends upgrading to a current supported release.
That is particularly important for organizations operating legacy infrastructure where unsupported software can remain exposed for years.
Site Servers and Secondary Servers Need Attention Too
Updating only the primary application server may not be enough.
PaperCut advises administrators to ensure that Site Servers and secondary/print servers are also upgraded to patched versions.
This is an important operational detail because distributed print architectures can contain multiple components that administrators may not immediately associate with the primary PaperCut application.
A forgotten secondary server can become the weakest link in an otherwise patched environment.
Some PaperCut Products Are Not Affected
Not every PaperCut component needs to be updated for these vulnerabilities.
PaperCut states that products such as Print Deploy and Mobility Print are not affected by these specific vulnerabilities.
However, administrators should carefully distinguish between affected and unaffected components rather than assuming that one product’s status applies to the entire PaperCut environment.
Why These Vulnerabilities Are More Dangerous Than They Look
Print Servers Are Attractive Internal Targets
The biggest mistake organizations can make is treating print infrastructure as unimportant.
A print server can interact with dozens, hundreds, or even thousands of devices.
It may have network visibility across multiple segments.
It may process authentication information.
It may communicate with workstations.
It may run continuously.
And, depending on the deployment, it can have significant privileges.
For an attacker, compromising such a system can therefore provide a useful staging point for further intrusion.
Internet Exposure Makes the Situation Worse
A management interface exposed directly to the internet dramatically increases the attack surface.
Attackers do not need an employee to click a malicious attachment if they can simply reach a vulnerable service remotely.
That is why PaperCut is recommending more than simply applying the patch.
The company also urges customers to restrict access to web interfaces to trusted IP addresses using:
Firewall rules
Network access controls
Segmentation
VPN access
Equivalent network restrictions
The principle is straightforward:
If administrators do not need to access the management interface from the public internet, it should not be publicly reachable.
What Administrators Should Look For After Patching
Patching Does Not Erase Previous Compromise
Organizations should avoid assuming that installing the patch automatically means the server is clean.
If attackers exploited the vulnerability before remediation, malicious activity could have occurred before the patch was applied.
That makes post-patch investigation essential.
PaperCut has specifically recommended monitoring for suspicious activity involving the pc-app.exe process, along with unusual server log behavior and specific database-related errors.
Suspicious Process Activity
Administrators should investigate unusual or unexplained activity associated with:
pc-app.exe
The process itself is legitimate, so its presence alone is not evidence of compromise.
The important question is whether its behavior is consistent with the normal PaperCut installation.
Unexpected child processes, unusual network connections, abnormal command execution, or activity occurring at strange times should receive additional scrutiny.
Missing or Truncated server.log Files
PaperCut has also warned administrators to look for missing or truncated server.log files.
Log manipulation is a common post-compromise technique because attackers understand that defenders rely heavily on logs to reconstruct what happened.
A missing or unexpectedly shortened log should therefore not automatically be dismissed as a routine software problem.
Specific Database Errors
Administrators should also search PaperCut logs for unusual errors such as:
ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
These messages do not automatically prove that exploitation occurred.
However, in the context of the current vulnerability, they are worth investigating—particularly if they appear alongside suspicious process activity, unexpected configuration changes, or network alerts.
Deep Analysis: Investigating a Potentially Compromised PaperCut Server
Start With Process Enumeration
On Windows, administrators can begin by checking running processes:
Get-Process | Where-Object {$_.ProcessName -match "pc-app"}
The goal is not simply to confirm that PaperCut is running, but to establish whether its execution behavior appears normal.
Check Process Details
Administrators can inspect the executable path and command line:
Get-CimInstance Win32_Process |
Where-Object {$_.Name -match "pc-app.exe"} |
Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine
Unexpected executable locations or unusual command-line arguments deserve closer examination.
Search PaperCut Logs
A basic PowerShell search can identify the indicators mentioned in the advisory:
Select-String <code>-Path "C:\Program Files\PaperCut MF\server\logs\server.log"</code> -Pattern "No suitable driver found for jdbc:no:x", "DatabaseUtils - Database error looking up cardID: VALUES CAST"
The actual installation path may differ between environments, so administrators should adjust the path accordingly.
Search for Log Tampering
Administrators can check file metadata to identify unusual changes:
Get-Item "C:\Program Files\PaperCut MF\server\logs\server.log" | Select-Object FullName, Length, CreationTime, LastWriteTime, LastAccessTime
Compare those timestamps with known maintenance windows and historical logging patterns.
A sudden reduction in file size or an unexpected timestamp should be investigated rather than immediately interpreted as proof of malicious activity.
Linux Investigation
For Linux deployments, administrators can begin by checking the PaperCut process:
ps aux | grep -i '[p]c-app'
Then inspect listening services:
ss -lntup
And review recent PaperCut log activity:
grep -Ei \n'No suitable driver found|DatabaseUtils.Database error' \n/path/to/papercut/server/logs/server.log
The exact installation path varies by deployment.
Look for Unexpected Network Connections
Network inspection can provide additional context.
On Windows:
Get-NetTCPConnection |
Where-Object {$_.State -eq "Established"} |
Sort-Object RemoteAddress
On Linux:
ss -tunap
The purpose is to identify unusual external communication associated with the PaperCut server.
Again, legitimate connections should be expected. The important task is identifying connections that do not fit the server’s normal operational profile.
Review Windows Event Logs
If compromise is suspected, administrators should also investigate Windows security and system logs.
For example:
Get-WinEvent -LogName Security -MaxEvents 500 |
Where-Object {$_.Id -in 4624,4625,4688}
These events can help establish authentication activity and process creation around the suspected compromise window.
Review Configuration Changes
Because one of the vulnerabilities involves configurable database driver behavior, unexplained changes to PaperCut configuration deserve particular attention.
Administrators should compare the current configuration with known-good backups or documented baseline settings.
A configuration change that occurred outside an authorized maintenance window is potentially important evidence.
Do Not Destroy Evidence
If compromise is suspected, administrators should avoid immediately deleting files, rebuilding logs, or aggressively cleaning the machine before collecting evidence.
A rushed cleanup can destroy indicators that security teams need to determine:
When access occurred
How attackers entered
What accounts were used
Which processes executed
Whether credentials were accessed
Whether lateral movement occurred
Whether additional malware was installed
The correct response is containment followed by controlled investigation.
Restrict the Management Interface Immediately
Network Controls Are an Important Second Layer
Even after patching, restricting administrative interfaces remains valuable.
A secure architecture should ideally prevent arbitrary external systems from reaching management interfaces in the first place.
Firewall rules can limit access to known administrator networks:
Internet
|
X Block direct access
|
Firewall
|
Trusted Admin Network
|
PaperCut Management Interface
The fewer systems that can reach the interface, the fewer systems can potentially exploit a future vulnerability.
Segmentation Reduces Blast Radius
PaperCut servers should also be evaluated from a network-segmentation perspective.
If a print server is compromised, segmentation can make it harder for an attacker to move from the printing environment into:
Domain controllers
File servers
Database servers
Backup systems
Administrative workstations
Security infrastructure
Security is not only about preventing the first compromise.
It is also about limiting what happens after the compromise.
The 2023 PaperCut Attacks Show Why This Matters
PaperCut Has Been Targeted Before
This is not the first time PaperCut infrastructure has attracted attackers.
In 2023, attackers exploited CVE-2023-27350, another PaperCut authentication-bypass and remote-code-execution vulnerability.
Those attacks eventually became associated with multiple threat actors and ransomware operations, including Clop, LockBit, Iranian state-backed groups, and the Bl00dy ransomware group.
That history provides important context.
PaperCut servers have already demonstrated their value as targets.
Attackers Know That Enterprise Software Can Open Bigger Doors
A vulnerability in a business application can be far more valuable than a vulnerability in an isolated desktop program.
Once an attacker gains execution on a trusted internal server, they can potentially use that position to explore the surrounding network.
The initial target may be a print server.
The ultimate objective may be something entirely different.
Why Patch Bypasses Should Concern Every Security Team
A Patch Is an Argument, Not a Guarantee
Modern vulnerability remediation is increasingly becoming an adversarial process.
Security researchers examine vulnerabilities.
Vendors produce fixes.
Researchers test those fixes.
Attackers perform the same process—but with malicious intent.
The discovery of multiple bypasses against the first PaperCut emergency patch demonstrates this reality.
The question is no longer simply:
Did we install the patch?
It becomes:
“Did we install the latest remediation, verify the version, remove unnecessary exposure, and investigate whether exploitation occurred before the fix?”
What Undercode Say:
1. This Is a Patch-Now Situation
The combination of active exploitation, authentication bypass, and potential remote code execution makes this a high-priority security issue.
2. The Second Patch Matters
Organizations that installed the first emergency release should not stop there.
PaperCut specifically released the second emergency patch because additional weaknesses were discovered.
3. Authentication Bypasses Are Especially Dangerous
An attacker who does not need valid credentials has already crossed one of the most important security boundaries.
4. Remote Code Execution Changes the Game
Code execution means the attacker may move beyond the application layer and interact directly with the underlying server.
5. The CVSS 9.4 Vulnerability Deserves Attention
CVE-2026-82078 carries a critical severity rating of 9.4.
That is not an issue administrators should postpone until the next maintenance cycle.
6. Internet Exposure Magnifies Risk
A vulnerable PaperCut server reachable from the internet gives attackers a much larger opportunity to attempt exploitation.
7. Internal-Only Does Not Mean Safe
Even if the server is not publicly accessible, compromised employee endpoints or other internal systems could potentially reach it.
8. Segmentation Matters
A properly segmented print environment can significantly reduce the consequences of a server compromise.
9. Patch Bypasses Are a Warning
The first emergency fix being bypassed demonstrates why security teams need to follow vendor updates after an emergency disclosure.
10. Version Tracking Is Essential
Organizations should maintain an accurate inventory of PaperCut versions across all servers.
11. Secondary Servers Cannot Be Forgotten
Site Servers and secondary print servers also need to be addressed.
12. Legacy Versions Increase Risk
Running PaperCut version 23 or earlier leaves organizations with a more complicated upgrade problem.
13. Logs Could Reveal the Attack
The specific errors provided by PaperCut give defenders useful investigation leads.
14. Log Integrity Matters
Missing or truncated logs should be treated seriously during an incident investigation.
15. Process Monitoring Can Help
Unexpected behavior from pc-app.exe may provide valuable clues.
16. Endpoint Security Should Be Correlated
EDR alerts from the PaperCut server should be examined alongside network and application logs.
17. Network Telemetry Is Equally Important
Unusual outbound connections can reveal post-exploitation activity.
18. Authentication Logs Add Context
Successful and failed logins can help establish whether an attacker interacted with the server before exploitation.
19. Configuration Changes Deserve Attention
Unexpected database-related configuration changes could be especially significant in this incident.
20.
Installing a patch fixes a vulnerability. It does not necessarily remove an attacker who exploited it earlier.
21. Incident Response May Be Necessary
Evidence of exploitation should trigger a formal security investigation rather than a simple software update.
22. Credentials Should Be Considered
If compromise is confirmed, credentials accessible from the server may need to be reviewed and potentially rotated.
23. Privileged Accounts Need Extra Scrutiny
Any administrative credentials used on a compromised server should be evaluated carefully.
24. Lateral Movement Is the Bigger Threat
The most damaging stage of an intrusion may occur after the initial PaperCut compromise.
25. Ransomware Operators Look for Trusted Infrastructure
History shows that enterprise application vulnerabilities can become entry points for financially motivated attackers.
26. PaperCut Has Previous Adversary Attention
The 2023 attacks demonstrate that attackers are already familiar with the platform.
27. Emergency Advisories Should Be Treated Differently
Normal patch cycles are not appropriate when exploitation is already occurring.
28. Restrict First, Then Patch
Where feasible, administrators should reduce network exposure while deploying the emergency update.
29. Zero Trust Principles Apply Here
A print server should not automatically be trusted simply because it sits inside the corporate network.
30. Administrative Interfaces Should Be Private
Management interfaces generally have no reason to be openly reachable from the public internet.
31. Defense in Depth Is Critical
Patching, firewall restrictions, EDR, segmentation, logging, and monitoring should work together.
32. Researchers Play an Important Role
The collaboration between PaperCut and external researchers helped uncover weaknesses in the original mitigation.
33. Responsible Disclosure Gives Defenders Time
Withholding technical details during an active investigation can help organizations deploy emergency fixes before exploitation becomes easier to reproduce.
34. Attackers Will Reverse Engineer Patches
Once technical information becomes public, organizations should expect greater scanning and exploitation activity.
35. Speed Matters After Disclosure
The gap between public disclosure and widespread exploitation can be extremely short.
36. Inventory Is a Security Control
You cannot patch systems you do not know exist.
37. Unsupported Software Is a Strategic Risk
Legacy applications often become difficult to defend when emergency vulnerabilities appear.
38. Recovery Planning Matters
Organizations should know how they would rebuild or isolate a PaperCut server before an incident occurs.
39. Print Infrastructure Deserves Security Attention
The incident is another reminder that seemingly mundane enterprise software can become a serious attack surface.
40. The Best Response Is Layered
The strongest response combines Emergency Patch Release 2, network restriction, threat hunting, log analysis, endpoint monitoring, and incident response where necessary.
✅ Fact: PaperCut Released a Second Emergency Patch
PaperCut has released Emergency Patch Release 2 after additional security research uncovered weaknesses in the initial remediation.
Customers are explicitly advised to install the second release even if they previously installed the first emergency patch.
✅ Fact: Two Vulnerabilities Were Disclosed
The vulnerabilities are identified as CVE-2026-81578 and CVE-2026-82078.
They affect PaperCut NG/MF and can be chained to create a potentially severe attack path.
✅ Fact: The Vulnerabilities Are Actively Exploited
The article states that PaperCut warned of active exploitation and that the attacks appear limited and targeted.
That makes this a real-world security incident rather than a vulnerability that exists only in laboratory research.
✅ Fact: One Vulnerability Has a 9.4 Severity Rating
CVE-2026-82078 is described as a critical unsafe dynamic class-loading vulnerability with a CVSS score of 9.4.
Its potential to facilitate arbitrary Java bytecode execution is the primary reason for its critical classification.
❌ Fact-Checking Caution: Exploitation Does Not Automatically Mean Every Server Is Compromised
The existence of active exploitation does not prove that every vulnerable PaperCut installation has been breached.
Administrators should investigate their own telemetry, logs, endpoint alerts, and network activity before concluding that compromise occurred.
Prediction
(+1) PaperCut Organizations Will Rapidly Move Toward Restricted Management Interfaces
The most likely positive development is that organizations will not only deploy Emergency Patch Release 2 but also reduce unnecessary exposure of PaperCut management interfaces.
This incident provides a strong argument for placing administrative web interfaces behind trusted networks, VPNs, firewalls, or access-control systems.
(+1) Security Teams Will Increase Monitoring of Enterprise Print Infrastructure
PaperCut is likely to receive considerably more attention from security operations teams following the incident.
Organizations that previously treated print servers as low-priority infrastructure may begin incorporating them into EDR, SIEM, vulnerability-management, and threat-hunting workflows.
(-1) Attack Attempts Could Increase After Technical Details Become Public
Once technical information about a remotely exploitable vulnerability becomes available, scanning and exploitation attempts can accelerate.
Organizations that delay the second emergency patch may therefore face greater risk as more attackers learn how the vulnerabilities work.
(-1) Previously Compromised Servers Could Become the Biggest Problem
The most dangerous systems may not be those that remain unpatched.
They may be the systems that were exploited before the emergency fixes were installed.
A server could be fully patched today while still containing persistence, stolen credentials, malicious modifications, or evidence of previous attacker activity.
Final Takeaway: Don’t Treat This as Just Another Print-Server Update
The PaperCut incident is a reminder of a security truth that organizations repeatedly learn the hard way: the most dangerous vulnerability is not always hiding inside the software everyone is watching.
Print infrastructure may appear mundane, but PaperCut servers can occupy a trusted position inside enterprise networks and expose powerful administrative functionality.
The combination of CVE-2026-81578 authentication bypass, CVE-2026-82078 unsafe dynamic class loading, active exploitation, and multiple bypasses of the initial remediation makes this incident especially important.
Administrators should deploy Emergency Patch Release 2, upgrade unsupported installations, update Site Servers and secondary servers, restrict management interfaces to trusted networks, and investigate suspicious activity before and after patching.
Most importantly, organizations should remember that patching closes a vulnerability—it does not prove that an attacker never got through it.
For security teams, the correct response is therefore broader than simply updating PaperCut.
Patch it. Restrict it. Monitor it. Hunt for compromise. And assume that anything exposed during an active exploitation window deserves a closer look.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
