CVE-2026-81578 & CVE-2026-82078: PaperCut Zero-Day Exploited, PoC Public

TL;DR

A PaperCut vulnerability is under active attack. The zero-day is an exploit chain, tracked as CVE-2026-81578 and CVE-2026-82078, that bypasses authentication and then executes malicious SQL to gain remote code execution. PaperCut confirmed customer incidents, and a public Metasploit proof-of-concept now exists.

Why It Matters

PaperCut NG and MF are print management platforms used across enterprises, universities, and government. Their Application Server exposes web-based admin functions. Any internet-facing PaperCut vulnerability therefore becomes a direct path into the network. PaperCut has been hit before: in 2023, CVE-2023-27350 was widely exploited by ransomware crews. That history raises the stakes for this new zero-day.

How the Attack Works

The chain starts with an authentication bypass, CVE-2026-81578. PaperCut uses the Apache Tapestry framework, whose request format can name one page to display and another to execute. PaperCut only checks access to the displayed page. By choosing a public error page, an attacker reaches privileged configuration components without logging in.

Next comes CVE-2026-82078, an unsafe dynamic class-loading flaw. The attacker rewrites PaperCut’s external database-lookup settings to point at a malicious connector. When a forged user search triggers that lookup, PaperCut executes the malicious SQL. The bundled database driver then chains to a JavaScript engine that starts an operating-system process, achieving remote code execution.

Affected Versions and Exploitation Status

PaperCut considers all versions of NG and MF potentially affected. This is confirmed exploited in the wild, per PaperCut’s advisory. A public proof-of-concept also exists. Rapid7’s Stephen Fewer published a Metasploit module covering MF and NG across the 24.x, 25.x, and 26.x branches. Notably, that module bypasses the first emergency patch.

Patch and Mitigation

Patch on an emergency basis. PaperCut released fixes for versions 24, 25, and 26. A second emergency patch was required after the first proved bypassable. Anyone who applied only the first version is not protected and must update again. The PaperCut security advisory has the latest builds and indicators. Also restrict web access to trusted internal IP ranges using firewall or reverse-proxy rules. The public Metasploit module confirms this PaperCut vulnerability is trivial to weaponize, so act now.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.