PaperCut NG/MF: Two Zero-Days Chained for Unauthenticated RCE, Incomplete Patches, and a CISA Deadline

> TL;DR: PaperCut confirmed customer incidents on its NG and MF print management software, with two flaws chained into unauthenticated code execution: CVE-2026-81578 (CVSS 8.8) bypasses access control in the web admin interface, then CVE-2026-82078 (CVSS 9.4) exploits unvalidated dynamic class loading in the database connection utilities to run arbitrary Java code inside the application process. The vendor shipped two successive emergency patches (v24, v25, v26); watchTowr identified bypasses of the first patch — and a bypass that still affects the latest fully patched version. CISA added both flaws to its KEV catalog, with a September 14, 2026 remediation deadline for US federal agencies.

The attack chain, step by step

watchTowr's summary captures the path: "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution."

Huntress's analysis details the first step: in unpatched versions, a specifically crafted request can refer to one page rendered for the response and another page that owns the component or action actually executed. PaperCut's authorization check trusted the rendered page and missed the permissions required by the component behind it — a classic gap between the displayed resource and the authorized one. Once past that check, the attacker modifies server configuration, reaches sensitive endpoints, and triggers unsafe actions.

The second step exploits class loading: the application instantiates JDBC driver classes from configurable driver names without validating against an allowlist of approved drivers. Whoever controls the configuration controls the loaded class — and therefore the executed code.

What has been observed in the field

The IoCs published by PaperCut and Huntress sketch an attack still exploratory on some sites but already operational on others:

By August 31, watchTowr observed the shift from scanning to real-world exploitation with hands-on-keyboard interaction — behavior typical of initial access brokers keying their in-memory payloads to keep exclusive access to compromised hosts.

The incomplete-patch problem

This is the most instructive part of the story. PaperCut shipped a first emergency patch; watchTowr and Huntress found bypasses in it. A second emergency patch arrived with additional hardening; watchTowr still identified new patch bypasses, some affecting the latest fully patched version. The vendor itself warns that IoC files may be erased as the attacker progresses. Operational translation: patching is necessary but not sufficient — any instance exposed to the Internet in recent weeks should be treated as potentially compromised and investigated, not just updated.

What to do

The broader lesson: a print server is a pivot

PaperCut concentrates three risk factors found in many internal tools: a historically Internet-exposed web admin interface, filesystem and shell access for its functions, and sensitive content in transit (printed documents, their history, print queues). In HR and payroll contexts, where payslips and employee files still end up on network printers, a compromised PaperCut server is both an entry door to the internal network and a data mine. The rule keeps proving itself: any internal admin portal exposed to the Internet eventually gets found, tested, and chained.