Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers are chaining two PaperCut vulnerabilities – one related to dynamic class loading and another to improper access control – to execute arbitrary code on susceptible instances without authentication. The vulnerability allows for remote code execution, and threat actors have been observed exploiting these flaws to gain control and fingerprint systems. PaperCut has released patches and recommends restricting access to mitigate the risk.
A newly patched security flaw in PaperCut NG and MF allows malicious actors to execute arbitrary code on susceptible instances, as PaperCut released a fresh emergency fix with additional hardening. Huntress researchers John Hammond and Andrew Brandt explained that an attacker can leverage an unauthenticated request to make changes to the server configuration and ultimately achieve code execution. Specifically, an unpatched version of PaperCut NG and MF allows a crafted request to refer to one page that is rendered for the response, and another page that owns the component or action being executed. PaperCut's authorization check could trust the rendered page and miss the permissions required by the component behind it. PaperCut has since publicly disclosed two flaws:
- CVE-2026-82078 (CVSS score: 9.4) - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.
- CVE-2026-81578 (CVSS score: 8.8) - An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.
WatchTower’s preemptive exposure management firm discovered that attackers are chaining together both vulnerabilities to bypass authentication and gain remote code execution on affected instances. They also found multiple patch bypasses and an additional authentication bypass vulnerability. The threat actors are deploying a Java .class file that is operating system agnostic and can run commands under either Linux or Windows systems to fingerprint the machine and obtain a directory listing of files stored on the computer. The data is written to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory. Once this step is complete, the .class file deletes "Udydn.out", the server's "server.log" file, and a "/data/internal/derby.log" file.
Organizations with PaperCut NG and MF in their environment are advised to remove public exposure immediately and apply the patch as soon as possible. It's also recommended to restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path. "PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated," Jake Knott, head of threat intelligence at watchTowr, said in a statement shared with The Hacker News. "Organizations with vulnerable internet-facing instances of PaperCut need to remove public internet access where possible, and begin hunting for signs of compromise, such as looking for 'Database error looking up cardID: VALUES CAST' errors in log files."