Security alert: Critical vulnerability chain in PaperCut exploited to gain server control

Thảo Nguyên
1 day ago
2 min read

PaperCut NG and MF print management systems are facing dangerous cyberattacks as threat actors exploit a chain of two security vulnerabilities to achieve remote system compromise without authentication.

How attackers bypass security controls

Cybersecurity experts report that attackers can exploit a flaw in PaperCut's access control validation mechanism. By sending a specially crafted request, the system is tricked into confusing the user interface rendering logic with backend execution functions, allowing the security mechanism to bypass authentication and grant unauthorized access to server configurations.

Vulnerability ID	CVSS score	Technical description	Role in attack chain
CVE-2026-81578	8.8 (High)	Broken access control in admin web interface	Bypasses authentication and triggers remote system features
CVE-2026-82078	9.4 (Critical)	Insecure dynamic class loading	Modifies config files and loads malicious drivers to achieve RCE

Real-world exploitation and attacker behavior

Observational data indicates that current exploitation attempts are primarily focused on initial reconnaissance and information gathering. Threat actors execute Base64-encoded commands to identify target user accounts and operating systems using the whoami & ver command string. In an incident recorded on August 27, 2026, the command was expanded to whoami & ver & tasklist to enumerate active running processes.

Simultaneously, a cross-platform Java .class file (capable of targeting both Windows and Linux environments) is dropped onto the system to gather host footprints and enumerate stored files. Initial reconnaissance findings are saved to Udydn.out under the /data/content/. Upon completing their objective, the attackers delete this file alongside server.log and /data/internal/derby.log to erase their tracks.

Patching challenges and emergency mitigation steps

PaperCut has released a second emergency patch targeting versions v24, v25, and v26 to reinforce system security. However, security research firms including Huntress and watchTowr report that working patch bypasses remain, affecting even fully updated instances.

PaperCut servers represent high-value targets because they serve as a bridge between the internet and corporate internal networks while processing sensitive print job data.

To protect their environments, organizations running PaperCut NG and MF should immediately execute the following actions:

Disconnect PaperCut servers from direct exposure to the public internet.
Restrict access to the PaperCut Application Server to trusted IP address ranges, or place the server behind a VPN/controlled management route.
Inspect log files for indicators of compromise, specifically searching for the error string: Database error looking up cardID: VALUES CAST.

Proactively isolating servers from the public internet and maintaining continuous log analysis are crucial steps for enterprises to prevent unauthorized system takeover while awaiting permanent fixes.

Reference: The Hacker News