CVE-2026-82078 (CVSS 9.4): PaperCut’s Emergency Patch Was Bypassed — Pre-Auth RCE Chain Is Being Exploited in the Wild

On the morning of August 26, 2026, threat actors were already inside enterprise print servers, executing reconnaissance commands through a vulnerability that didn’t even have a CVE number yet. Within days, PaperCut pushed an emergency patch. Within hours, attackers found a way around it. A second emergency patch followed — and now, every organisation running PaperCut NG or PaperCut MF with an internet-facing Application Server is racing a sophisticated adversary that has, at minimum, a two-week head start.

If your enterprise — school, hospital, bank, or government office — uses PaperCut for print management, this is the threat brief you cannot afford to miss.

The Two Vulnerabilities and Why They’re Deadly Together

PaperCut is a print management platform trusted by over 140 million users across 70,000-plus organisations — universities, hospitals, financial institutions, law firms, and government departments all rely on it to manage copiers, MFDs, and 3D printers. Its Application Server exposes a web management interface on port 9191 (HTTP) or 9192 (HTTPS). When that interface is reachable from the internet — a common configuration in many Indian enterprise and campus environments — these two flaws become a direct foothold into the internal network.

CVE	Type	CVSSv4	Auth Required	Impact
CVE-2026-82078	Unsafe Dynamic Class Loading	9.4 Critical	None (when chained)	Arbitrary Java code execution on server
CVE-2026-81578	Authentication Bypass (Improper Access Control)	8.8 High	None	Unauthenticated system-configuration modification

Technical Breakdown: How the Pre-Auth RCE Chain Works

CVE-2026-81578 is the entry point. The PaperCut NG/MF web management interface contains a race-condition-style improper access control flaw in its request-processing pipeline: unauthenticated requests that target certain administrative endpoints can trigger backend actions before the authentication gate is fully evaluated. An attacker can exploit this to modify system configuration values — specifically, the database connection driver class name — without ever supplying valid credentials.

That matters because CVE-2026-82078 is exactly the weapon that driver-class field loads. PaperCut’s Application Server dynamically instantiates Java database driver classes based on a configurable name stored in that settings field. Critically, it validates driver names against no allowlist whatsoever — any class on the Java classpath can be specified. By writing a malicious class name via CVE-2026-81578 and then triggering a database-connection test action, an attacker forces the Application Server to instantiate and execute arbitrary Java code, achieving full Remote Code Execution on the server host.

In confirmed incidents, the PaperCut Application Server runs as SYSTEM on Windows or as root on Linux. That means RCE equals total host compromise from the very first packet — no privilege escalation step required.

Huntress researchers who reproduced the full chain observed attackers issuing base-64 encoded reconnaissance commands (system information, user enumeration, network discovery) seconds after exploitation. PaperCut’s extensive logging normally captures most administrative actions — yet these attackers operated in a window before most organisations had even been alerted that a patch existed.

The Emergency Patch That Wasn’t Enough

PaperCut disclosed the vulnerabilities on August 27, 2026, shipping Emergency Patch Release 1 the same day. Security firm watchTowr fully reproduced both flaws and identified multiple alternative exploitation paths — including bypasses of the Release 1 patch — within roughly 48 hours. PaperCut shipped Emergency Patch Release 2 shortly after, then a consolidated Release 3 on September 1, 2026, incorporating comprehensive fixes.

According to BleepingComputer, attackers were already probing the Release 1 patch boundary while enterprise administrators were still applying it. This is a textbook example of adversarial patch reverse-engineering — a trend accelerating in 2026 as threat actors race patch-diffing tools against vendor turnaround times.

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31, 2026, setting a September 21, 2026 deadline for all U.S. Federal Civilian Executive Branch agencies.

Who Is at Risk? The India Angle

PaperCut is the de-facto print management standard for Indian higher education institutions (IITs, IIMs, central universities), large hospitals, public-sector banks, and manufacturing enterprises. Many of these deployments expose the Application Server management interface on public or semi-public networks for remote administration convenience. That convenience is now an open door.

Unlike many Western environments where firewall rules frequently restrict access to management interfaces, Indian enterprise networks often operate with more permissive east-west and perimeter rules — partly due to flat legacy network architectures. A zero-trust segmentation gap here translates directly into an exploitable attack surface.

The eSentire advisory notes that internet-facing PaperCut servers are readily discoverable via Shodan and Censys — meaning opportunistic threat actors don’t need to target organisations individually; they can sweep entire ASNs.

What You Should Do Right Now

As a cybersecurity practitioner advising enterprise and government clients across Delhi NCR and beyond, my immediate recommendation follows a three-tier priority framework:

1. Patch immediately — to Release 3, not Release 1 or 2. Upgrade to PaperCut NG/MF version 22.1.4, 23.0.8, 24.0.3 or later. Verify with the vendor changelog that you have applied the consolidated fix, not an earlier partial patch. Confirm your version in the PaperCut Admin UI under About PaperCut > Version.
2. Restrict access to the Application Server management port (9191/9192) immediately. Place a firewall rule or WAF rule blocking all unauthenticated internet access to these ports. If your management interface is internet-facing, treat this as a P0 incident until patched. Even after patching, management interfaces should never be internet-reachable without VPN or Zero Trust Network Access.
3. Review PaperCut server logs for signs of exploitation. Look for unusual configuration changes in the PaperCut audit log, unexpected new administrative accounts, or process execution anomalies on the Application Server host. Indicators include base64-encoded PowerShell or bash commands executed under the PaperCut service account.

Additionally:

• Disable the Allow external system accounts to sync and unnecessary database-connection test endpoints if not operationally required.
• Implement network micro-segmentation so the print server cannot reach sensitive internal resources (AD, HR databases, file shares) even if compromised — a core Zero Trust principle.
• Subscribe to PaperCut’s official security bulletins so you receive emergency patch notifications before advisories reach mainstream news channels.
• Conduct a threat hunt across any PaperCut server that was internet-accessible during August 26 – September 1, 2026. Assume compromise and validate, rather than assuming clean and finding out too late.

For organisations already practicing Zero Trust, this event reaffirms the architecture: a PaperCut server constrained by least-privilege networking, strict egress controls, and endpoint detection can limit blast radius even if RCE is achieved. See how we’ve deployed FortiGate SD-WAN micro-segmentation to enforce exactly this posture for enterprise clients.

This incident also joins a growing list of critical vulnerabilities that earned CISA KEV listings in the first week of September 2026 alone — from SonicWall SMA 1000 to Citrix NetScaler. For an overview of how your organisation should structure its response to KEV additions, review our CISA KEV action-plan post.

Frequently Asked Questions

Do I need to be an authenticated administrator for these flaws to be exploited?

No. The exploit chain — CVE-2026-81578 leading to CVE-2026-82078 — is pre-authentication. An unauthenticated attacker with network access to the PaperCut Application Server’s management port (9191/9192) can achieve full RCE without supplying any credentials. This is what makes these vulnerabilities so severe.

Is the cloud-hosted PaperCut SaaS (“PaperCut Hive” / “PaperCut EDI”) affected?

No. PaperCut’s cloud-hosted SaaS products are managed by PaperCut Software and were patched by the vendor without customer action required. Only self-hosted PaperCut NG and PaperCut MF Application Servers require the emergency patch. If you are unsure which deployment model your organisation uses, check with your IT team or managed print service provider.

How do I confirm I’m on the correct patched version?

Log in to the PaperCut Admin interface and navigate to About PaperCut. Version numbers that are safe include 22.1.4+, 23.0.8+, and 24.0.3+. If you are on an older major release branch (e.g., 21.x or earlier), upgrade to the latest supported branch, as PaperCut has not back-ported fixes to end-of-life releases.

What if we cannot patch immediately — is there a workaround?

PaperCut’s official workaround is to restrict access to the Application Server management interface so it is only reachable from trusted internal IP ranges or via VPN. Block TCP ports 9191 and 9192 at your perimeter firewall and any internal firewall segments. This does not fix the underlying vulnerability but removes the attack surface until patching can be scheduled. Do not rely on this workaround beyond 72 hours — schedule an emergency change window.

---