"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said.
How Huntress says the chain works
Huntress researchers described a two-step chaining technique that lets unauthenticated remote requests manipulate the PaperCut server configuration and access sensitive endpoints. In unpatched PaperCut NG and PaperCut MF instances, a crafted request can refer to a page that is rendered for the response while invoking a different page that owns the component or action being executed. PaperCut's authorization check can trust the rendered page and therefore miss the permissions required by the component behind it. Huntress concluded that this gap can be used by an unauthenticated actor to make configuration changes that then expose unsafe backend actions and ultimately permit execution of arbitrary, attacker-controlled Java code inside the application process.
The two disclosed flaws: CVE-2026-82078 and CVE-2026-81578
PaperCut publicly disclosed two distinct vulnerabilities tied to this chain. CVE-2026-82078 (CVSS score: 9.4) is an unsafe dynamic class loading issue in the product's database connection utilities: the application instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. CVE-2026-81578 (CVSS score: 8.8) is an improper access control vulnerability in the web management interface. Under specific conditions, unauthenticated remote requests that target administrative functions can trigger backend actions before access validation checks complete. Combined, these flaws create a path from unauthenticated request to configuration change to remote code execution, according to the public disclosures and Huntress analysis.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleObserved exploitation, payloads, and cleanup behavior
Huntress reported limited exploitation observed on two customer environments. In those cases, attackers executed Base64-encoded commands on the targeted server as part of post-exploitation activity, using a chained command such as "whoami & ver" to fingerprint user account and operating system.
Attackers also deployed a Java .class file that is operating-system agnostic and can run commands under either Linux or Windows. That .class file is used to fingerprint the machine and obtain a directory listing; the recorded behavior writes the output to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory. Once the actors completed that step, the .class file deleted "Udydn.out," the server's "server.log," and "/data/internal/derby.log."
In a separate incident recorded on August 27, 2026, threat actors used a different .class file variant that ran a tweaked command sequence, "whoami & ver & tasklist," to also capture a list of running processes.
watchTowr's analysis and PaperCut's emergency response
Preemptive exposure management firm watchTowr reported that attackers are chaining both vulnerabilities to bypass authentication and achieve remote code execution on affected instances. watchTowr said it also discovered multiple patch bypasses and an additional authentication bypass vulnerability; the company assessed that those issues are "likely to have been addressed as part of the second emergency patch." The Hacker News contacted watchTowr for comment.
PaperCut released a second emergency patch described as including "additional hardening beyond the original emergency patch." The Australian company has not shared further public details about the nature of the malicious activity weaponizing the flaws.
Jake Knott, head of threat intelligence at watchTowr, warned in a statement shared with The Hacker News that "PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated." watchTowr advised organizations with internet-facing instances to remove public internet access where possible and begin hunting for signs of compromise, including looking for "Database error looking up cardID: VALUES CAST" errors in log files.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Remove public exposure of PaperCut instances immediately where practical, apply PaperCut's emergency patch as soon as possible, and restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path.
- Affected enterprises and procurement leaders: Treat internet-facing PaperCut NG and MF deployments as high-priority remediation cases; the combination of an access-control bypass and unsafe dynamic class loading can allow unauthenticated actors to execute arbitrary Java code inside the application process, per Huntress and the product disclosures.
- End users and administrators: Look for the specific post-exploitation artifacts Huntress observed — Base64-encoded command execution, a "Udydn.out" file under /data/content/, and deletion of server.log and /data/internal/derby.log — and follow guidance to hunt for the log error string "Database error looking up cardID: VALUES CAST" highlighted by watchTowr.
PaperCut has issued emergency updates and additional hardening, but the company has yet to publish a detailed post-incident account of the attacks observed in the wild. For organizations running PaperCut NG or MF, the immediate steps are clear in the disclosures and advisories: remove public exposure where practicable, apply the vendor's emergency patches, and hunt the specific indicators cited by Huntress and watchTowr.
Original reporting: https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html
