PaperCut zero-day: two CVEs, active attacks, patch now

PaperCut confirmed on August 27 that attackers are exploiting a previously unknown flaw in PaperCut NG and PaperCut MF — the print management software sitting on a Windows box in half the small offices, clinics, and school districts in the country. Emergency patches went out the same day. A second, hardened patch went out the day after. If you run PaperCut, this is a today job, and the reason has nothing to do with printing.

What actually happened

PaperCut's security bulletin went up as an urgent advisory for all NG/MF customers, with the vendor stating it was aware of confirmed customer incidents. Per Help Net Security, the bug was surfaced by a university customer's own security and forensics team, whose findings let PaperCut engineers reproduce it and confirm in-the-wild abuse.

Two CVEs were assigned on August 28:

• CVE-2026-82078 — unsafe dynamic class loading, allowing arbitrary Java bytecode execution
• CVE-2026-81578 — improper access control, allowing unauthenticated configuration changes

Chain them and an unauthenticated attacker who can reach the web interface gets code running inside the application's JVM. That is pre-auth remote code execution on a server that holds your directory bindings and your database credentials.

Huntress documented limited post-exploitation on two customer environments: encoded reconnaissance (whoami & ver), then malicious Java class files — Udydn.class and Moo97.class — dropped for system profiling and directory enumeration. The classes ran on both Linux and Windows, wrote command output to files, and deleted their traces, including the server logs.

Indicators worth grepping for right now: intrusion alerts naming pc-app.exe, missing or truncated server.log files, and log lines reading ERROR No suitable driver found for jdbc:no:x or ERROR DatabaseUtils - Database error looking up cardID. PaperCut is explicit that the absence of these does not mean you are clean.

On patches: PaperCut is treating all NG and MF versions as potentially affected and shipped out-of-cycle builds for both the v25 and v26 branches across Windows, Linux, and macOS. After further work with Huntress and watchTowr, it published an Emergency Patch Release 2 with additional hardening and recommends every customer install it — including anyone who already applied the first one.

Why an unpatched print server matters for your business

Nobody has "print management" on the risk register. It got installed once, by whoever set up the copier contract, and it has been quietly working ever since. That is exactly the profile attackers like: a Java application server with domain credentials, network reachability, and no owner.

Three things today:

Find it. PaperCut arrives through managed print providers and copier vendors more often than through IT. Check for pc-app.exe on Windows hosts and port 9191/9192 listeners on your network.

Get it off the internet. PaperCut's own guidance is to restrict Application Server web access to trusted IP addresses via firewall rules or network ACLs. There is no version of this software that belongs on a public IP.

Apply Release 2, then assume compromise if you were exposed. Preserve server.log, config files, and process trees before patching if you can — the attackers delete logs, so absence of evidence is the evidence. Then rotate what that box could reach: the AD or LDAP service account, the database credentials, and any API keys in its config.

The general rule, again: your attack surface is not the software you chose. It is the software that got installed to make a printer work in 2019 and never appeared in a budget line since.

Sources: PaperCut Security Bulletin, Huntress, Help Net Security.