Executive Summary
In August 2026, threat actors actively exploited two chained vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8) allows attackers to bypass authentication through improper access control, while CVE-2026-82078 (CVSS 9.4) enables unsafe dynamic class loading for arbitrary code execution. Huntress researchers observed limited exploitation targeting internet-facing instances, with attackers performing reconnaissance commands and deploying Java payloads to fingerprint systems and exfiltrate data before cleaning up evidence.
This incident highlights the growing trend of vulnerability chaining attacks targeting enterprise infrastructure software, particularly as organizations increasingly rely on cloud-connected print management systems that often lack proper network segmentation and access controls.
Why This Matters Now
PaperCut systems are ubiquitous in enterprise environments and often internet-exposed, making them high-value targets for initial access. The active exploitation of these chained vulnerabilities demonstrates attackers' increasing sophistication in combining authentication bypasses with code execution flaws.
Attack Path Analysis
Attackers exploited chained PaperCut vulnerabilities CVE-2026-81578 and CVE-2026-82078 to achieve unauthenticated remote code execution on internet-facing instances. The attack progressed from initial exploitation through system reconnaissance, with potential for lateral movement and data exfiltration from the print management infrastructure.
Kill Chain Progression
Initial Compromise
Description
Attackers leveraged CVE-2026-81578 authentication bypass to access administrative functions, then chained CVE-2026-82078 unsafe dynamic class loading to achieve remote code execution on internet-facing PaperCut NG/MF instances
Related CVEs
CVE-2026-82078
CVSS 9.4An unsafe dynamic class loading vulnerability in PaperCut NG and MF database connection utilities allows unauthenticated attackers to execute arbitrary code by manipulating database driver class instantiation without validation against approved drivers.
Affected Products:
PaperCut Software PaperCut NG – < 23.0.8
PaperCut Software PaperCut MF – < 23.0.8
Exploit Status:
exploited in the wildCVE-2026-81578
CVSS 8.8An improper access control vulnerability in PaperCut NG and MF web management interface allows unauthenticated remote requests to trigger backend administrative actions before access validation checks complete.
Affected Products:
PaperCut Software PaperCut NG – < 23.0.8
PaperCut Software PaperCut MF – < 23.0.8
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: JavaScript
Abuse Elevation Control Mechanism: Bypass User Access Control
System Owner/User Discovery
System Information Discovery
Process Discovery
Indicator Removal on Host: File Deletion
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Vulnerability Management Program
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – Third-Party Risk Management
Control ID: Article 8
CISA ZTMM 2.0 – Application Layer Security Controls
Control ID: Application Security
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Higher Education/Acadamia
Educational institutions face critical risk from PaperCut vulnerabilities enabling remote code execution on widely-deployed campus printing infrastructure, compromising sensitive student data.
Health Care / Life Sciences
Healthcare organizations using PaperCut for document management face HIPAA compliance violations and patient data exposure through chained authentication bypass vulnerabilities.
Financial Services
Banks and financial institutions risk regulatory non-compliance and confidential document exposure through PaperCut's unauthenticated remote code execution capabilities affecting transaction processing environments.
Government Administration
Government agencies face critical infrastructure compromise through PaperCut vulnerabilities, enabling unauthorized access to classified documents and administrative systems via printing infrastructure.
Sources
- Attackers Chain Two PaperCut Flaws to Execute Code Without Authenticationhttps://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.htmlVerified
- PaperCut Security Bulletin - Urgent Security Advisoryhttps://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/Verified
- Huntress Research Blog - PaperCut Actively Exploitedhttps://www.huntress.com/blog/papercut-actively-exploitedVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF would have limited the attack's reach by constraining lateral movement from compromised PaperCut servers and reducing the blast radius through workload segmentation and controlled egress paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial compromise of internet-facing PaperCut instances would likely still occur, but the compromised workloads would be contained within segmented network boundaries limiting their connectivity to other infrastructure components
Control: Zero Trust Segmentation
Mitigation: While code execution within the compromised process would likely persist, zero trust segmentation would constrain the scope of accessible administrative resources and reduce the attack surface available for further exploitation
Control: East-West Traffic Security
Mitigation: Lateral movement attempts to connected printers, file shares, and network resources would likely be significantly constrained by east-west traffic inspection and microsegmentation policies blocking unauthorized cross-workload communications
Control: Multicloud Visibility & Control
Mitigation: Command and control communications would likely face restrictions through visibility controls and traffic inspection, potentially limiting the attacker's ability to maintain persistent communication channels and execute remote commands effectively
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts would likely be constrained by egress security policies that control outbound data flows, reducing the volume and scope of sensitive information that could be successfully transmitted from compromised print infrastructure
While service disruption to the compromised print management system would likely persist, the overall impact scope would be reduced through workload isolation that prevents cascading failures to other business-critical infrastructure components
Impact at a Glance
Affected Business Functions
- Document Management Systems
- Print Infrastructure
- Administrative Web Interfaces
- Database Services
Estimated downtime: 3 days
Estimated loss: N/A
Potential access to print job documents, user authentication data, system configuration files, and database contents through arbitrary code execution capabilities
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate print management systems from critical network resources and prevent lateral movement
- • Deploy Inline IPS (Suricata) with CVE-specific signatures to detect and block exploitation attempts against known vulnerabilities
- • Enable Multicloud Visibility & Control to monitor for anomalous interactions and repeated malformed requests targeting administrative interfaces
- • Configure Egress Security & Policy Enforcement to prevent unauthorized outbound data transfers from compromised print infrastructure
- • Establish Cloud Firewall (ACF) controls to restrict internet-facing application exposure and implement secure outbound access policies
