PaperCut released an emergency patch on August 28, 2026 for two vulnerabilities already being exploited in the wild. Then, the same day, it released a second one — because researchers at watchTowr had broken the first.

The two flaws are:

  • CVE-2026-82078 (CVSS 9.4) — unsafe dynamic class loading in the database connection utilities of PaperCut NG and PaperCut MF.
  • CVE-2026-81578 (CVSS 8.8) — improper access control in the web management interface, allowing unauthenticated remote requests to reach administrative functions before the server finishes validating access.

Chained, they give an unauthenticated attacker who can reach the management interface a path to code execution on the print server. The vendor published an urgent security bulletin on August 27 and pushed the first emergency patch for NG/MF versions 25 and 26 the following day.

Huntress has observed attacks against at least two customers, with the first exploitation attempts dated August 26 — before the bulletin existed.

Why the second patch shipped hours after the first

watchTowr reported multiple bypasses of the initial fix, plus an additional authentication bypass flaw the first patch did not address. PaperCut responded the same day with a second emergency release carrying additional hardening and extending coverage back to version 24, which the first patch had not included.

That is an ugly 24 hours for a vendor, but the alternative is worse. A patch that stops the exact published proof-of-concept and nothing adjacent to it is a patch that buys a defender a weekend, and the version-24 gap in the first release meant a large installed base was still fully exposed after applying what they had been told was the fix.

The operational consequence for defenders is simple and important: if you patched PaperCut on August 28, check which patch you got. An organization that pulled the morning build and marked the ticket closed is not covered.

PaperCut NG and MF are print management platforms. On paper that reads like a low-tier asset. In practice a print management server is one of the more attractive footholds in an enterprise network, for reasons that have nothing to do with printing:

  • It is domain-joined and often runs with elevated service account privileges, because it needs to authenticate users and enumerate directory objects to enforce print quotas and release rules.
  • It talks to everything. Print servers are deliberately reachable from every user subnet, which makes them an unusually well-connected pivot point.
  • It is frequently internet-exposed, to support mobile printing, guest release, and remote users.
  • It is rarely in the tier-one patch cadence, because it is categorized as an IT service tool rather than a security-relevant system.
  • It holds directory credentials and print job metadata, which is a meaningful intelligence source in its own right — contracts, HR letters, financial statements and legal documents all pass through it.

This is also not PaperCut’s first appearance in this position. The CVE-2023-27350 exploitation wave in April 2023 saw Cl0p and LockBit affiliates, plus Iranian state-linked actors, use PaperCut servers as an initial access route into enterprise networks. The lesson from that round — that print infrastructure is ransomware initial-access infrastructure — has clearly not propagated into patch prioritization at the pace it should have.

What to do now

  1. Apply the second emergency patch, not the first. Confirm the build number against PaperCut’s August 27 bulletin rather than the date you applied it.
  2. Get the management interface off the internet. There is no configuration in which the PaperCut admin console should be reachable from the open internet. Put it behind VPN or a reverse proxy with authentication in front.
  3. Hunt backward to August 24 at minimum. Exploitation predates the advisory. Look for unexpected child processes of the PaperCut service account, new scheduled tasks, JDBC or class-loading errors in application logs, and outbound connections from the print server to unfamiliar destinations.
  4. Rotate the PaperCut service account credentials and audit its directory privileges. If it is a domain admin — and it sometimes is — treat that as a finding independent of this CVE.
  5. Reclassify print infrastructure. If your patch SLA for PaperCut is 30 days and your SLA for the VPN concentrator is 72 hours, this incident is the argument for changing that.

The window between the first exploitation attempt on August 26 and a durable fix on August 28 was roughly 48 hours, and the fix required two attempts. Assume compromise if your instance was internet-facing in that period.

Sources