--- title: PaperCut NG and MF under active zero-day exploitation,... description: PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,... canonical: https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PaperCut NG and MF under active zero-day exploitation, patches released | daily.dev og:description: PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,... og:url: https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b og:image: https://api.daily.dev/og/posts/PAIVXH34b.png og:image:alt: PaperCut NG and MF under active zero-day exploitation, patches released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PaperCut NG and MF under active zero-day exploitation, patches released **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 0 comments ## Summary PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software, with confirmed incidents already reported. Emergency patches are available for public-facing servers; those unable to patch immediately should restrict web interface access via firewall rules or take the server offline. Indicators of compromise include suspicious activity from pc-app.exe, tampered server.log files, and specific JDBC/database errors. Print management software running with elevated privileges makes it an attractive target, as shown by the 2023 CVE-2023-27350 exploitation by Clop, LockBit, Iranian state-backed groups, and Bl00dy. ## Content PaperCut has confirmed active exploitation of a critical zero-day affecting all versions of PaperCut NG and PaperCut MF, its widely deployed print management software. The company published an urgent advisory on August 27, 2026, and has since issued two rounds of emergency patches after researchers found ways to bypass the first fix. ## What the vulnerability does The attack chain exploits Apache Tapestry's 'complex direct' request format to bypass page-level authentication entirely — no credentials required. Once past that gate, attackers can invoke privileged `ConfigEditor` and `UserList` components to reconfigure the server's external database lookup settings. From there, they inject a malicious JDBC connection that chains Apache Derby's `foreignViews` feature, an H2 database trigger, and the Nashorn JavaScript engine to achieve remote code execution. The result: arbitrary Java code running at SYSTEM-level privileges on the target server. Two CVEs have been assigned: - **CVE-2026-81578** — authentication bypass (CVSS 8.8) - **CVE-2026-82078** — unsafe dynamic class loading enabling RCE (CVSS 9.4) Chained together, they let an unauthenticated attacker go from zero to full server compromise. ## What attackers are actually doing Huntress observed real-world exploitation in two customer environments. Attackers ran base64-encoded reconnaissance commands and dropped a malicious Java `.class` payload via an attacker-controlled SMB2 share. The payload profiled the system and then deleted itself to cover tracks. Huntress also independently reproduced the full pre-auth RCE chain against a stock PaperCut NG 25.0.11.75758 install, confirming SYSTEM-level code execution. PaperCut has confirmed customer incidents with real damage, though it hasn't disclosed attacker identity or post-exploitation behavior while the investigation is ongoing. ## Patch history: two rounds PaperCut released an initial emergency patch for versions 25 and 26 on August 28, 2026 at 02:10 AEST (builds 25.0.12.76497/76496). Researchers from Watchtowr and Huntress subsequently identified bypass techniques and a new authentication bypass flaw, prompting a second emergency patch (Emergency Patch Release 2) covering versions 24, 25, and 26 on Windows, Linux, and macOS. Customers on version 23 or earlier won't receive a patch — they need to upgrade. ## What to do now - **Patch immediately** to the latest Emergency Patch Release 2 build for your version - **Remove public internet exposure** of the PaperCut Application Server if at all possible - **Restrict web interface access** to trusted IP ranges via firewall rules - **Block outbound SMB traffic** from the PaperCut server to prevent payload delivery via SMB2 shares - **Preserve logs** — don't let forensic evidence get overwritten ## Indicators of compromise Watch for: - Suspicious process activity from `pc-app.exe` - Modified or missing `server.log` files - Specific JDBC and database error strings in logs (PaperCut's advisory lists these) ## Context: PaperCut has been here before This isn't the first time PaperCut has been mass-exploited. CVE-2023-27350, disclosed in 2023, was picked up by Clop and LockBit ransomware operators, Iranian state-backed threat groups, and the Bl00dy ransomware gang. PaperCut's broad enterprise deployment makes it a recurring target — which is exactly why leaving these servers internet-facing is a bad idea even when there's no active zero-day. ## Questions this post answers ### What CVEs are associated with the PaperCut NG and MF zero-day exploit chain? Two CVEs cover the chain: CVE-2026-81578, an authentication bypass with a CVSS score of 8.8, and CVE-2026-82078, an unsafe dynamic class loading flaw enabling remote code execution with a CVSS score of 9.4. Chained together, they let an unauthenticated attacker achieve full SYSTEM-level compromise of the PaperCut Application Server by abusing Apache Tapestry's request handling and a malicious JDBC connection. _Teams tracking PaperCut exposure can follow CVE details and patch guidance as they develop on daily.dev._ ### Which PaperCut NG and MF versions are covered by the Emergency Patch Release 2? Emergency Patch Release 2 covers versions 24, 25, and 26 on Windows, Linux, and macOS, released after researchers from Watchtowr and Huntress found bypasses for the initial patch shipped for versions 25 and 26 on August 28, 2026 (builds 25.0.12.76497/76496). Customers on version 23 or earlier will not receive a patch and must upgrade instead. _Anyone patching PaperCut servers can check version-specific fixes and workarounds on daily.dev before deciding to upgrade._ ### How are attackers exploiting the PaperCut zero-day in the wild? Huntress observed attackers running base64-encoded reconnaissance commands and dropping a malicious Java .class payload via an attacker-controlled SMB2 share against real customer environments. The payload profiled the compromised system and then deleted itself to cover its tracks. Huntress also independently reproduced the full pre-auth remote code execution chain against a stock PaperCut NG 25.0.11.75758 install, confirming SYSTEM-level code execution. _Security teams investigating suspicious PaperCut activity can compare indicators of compromise shared on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PaperCut NG and MF under active zero-day exploitation, patches released","url":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b"},"datePublished":"2026-08-28T06:01:10.606Z","dateModified":"2026-09-13T19:31:15.972Z","description":"PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1665cb4f32d4e85197c5e84f54d05591?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1665cb4f32d4e85197c5e84f54d05591?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"PaperCut NG and MF under active zero-day exploitation, patches released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b#faq","mainEntity":[{"@type":"Question","name":"What CVEs are associated with the PaperCut NG and MF zero-day exploit chain?","acceptedAnswer":{"@type":"Answer","text":"Two CVEs cover the chain: CVE-2026-81578, an authentication bypass with a CVSS score of 8.8, and CVE-2026-82078, an unsafe dynamic class loading flaw enabling remote code execution with a CVSS score of 9.4. Chained together, they let an unauthenticated attacker achieve full SYSTEM-level compromise of the PaperCut Application Server by abusing Apache Tapestry's request handling and a malicious JDBC connection. Teams tracking PaperCut exposure can follow CVE details and patch guidance as they develop on daily.dev."}},{"@type":"Question","name":"Which PaperCut NG and MF versions are covered by the Emergency Patch Release 2?","acceptedAnswer":{"@type":"Answer","text":"Emergency Patch Release 2 covers versions 24, 25, and 26 on Windows, Linux, and macOS, released after researchers from Watchtowr and Huntress found bypasses for the initial patch shipped for versions 25 and 26 on August 28, 2026 (builds 25.0.12.76497/76496). Customers on version 23 or earlier will not receive a patch and must upgrade instead. Anyone patching PaperCut servers can check version-specific fixes and workarounds on daily.dev before deciding to upgrade."}},{"@type":"Question","name":"How are attackers exploiting the PaperCut zero-day in the wild?","acceptedAnswer":{"@type":"Answer","text":"Huntress observed attackers running base64-encoded reconnaissance commands and dropping a malicious Java .class payload via an attacker-controlled SMB2 share against real customer environments. The payload profiled the compromised system and then deleted itself to cover its tracks. Huntress also independently reproduced the full pre-auth remote code execution chain against a stock PaperCut NG 25.0.11.75758 install, confirming SYSTEM-level code execution. Security teams investigating suspicious PaperCut activity can compare indicators of compromise shared on daily.dev."}}]} ```