Recent security breaches have revealed the exploitation of critical vulnerabilities in PaperCut NG and MF, enabling unauthorized code execution on affected systems. Detailed analysis by Huntress researchers highlights the potential risks associated with these flaws.
Understanding the Vulnerabilities
Huntress researchers, John Hammond and Andrew Brandt, have identified that attackers can manipulate an unauthenticated request to alter server configurations, leading to arbitrary Java code execution within PaperCut processes. This vulnerability allows unauthorized control over PaperCut’s trusted settings, posing significant security risks.
The exploitation occurs when attackers use a crafted request to access a page rendered for response while executing actions from another page. This bypasses authorization checks, granting access to sensitive endpoints and allowing malicious code execution.
Detailed Breakdown of Security Flaws
PaperCut has publicly disclosed two major vulnerabilities: CVE-2026-82078 and CVE-2026-81578. CVE-2026-82078 is a severe dynamic class loading flaw in the database connection utilities, with a CVSS score of 9.4, permitting unsafe instantiation of database driver classes.
Meanwhile, CVE-2026-81578, rated 8.8 on the CVSS scale, involves improper access control in the web management interface. It allows unauthenticated remote requests to trigger backend actions before access validation is complete, further endangering system integrity.
Impact and Response
The urgency of addressing these vulnerabilities is underscored by the release of a second emergency patch by PaperCut, aimed at further hardening systems beyond the initial fix. However, details on the malicious activities exploiting these flaws remain undisclosed.
Jake Knott from watchTowr highlights that attackers are chaining both vulnerabilities to bypass authentication, exploiting them for remote code execution. The discovery of multiple patch bypasses indicates ongoing risks, emphasizing the need for immediate system updates.
Huntress has observed limited exploitation in client environments, with attackers using Base64-encoded commands to gather user and system information. Additionally, a Java .class file has been deployed to execute cross-platform commands, creating and subsequently deleting files to cover tracks.
Recommendations for Organizations
Organizations using PaperCut NG and MF are urged to remove public exposure of their systems and apply the latest patches promptly. Restricting access to trusted IPs or using a VPN is also advised to enhance security.
Given the potential for data exfiltration through printed documents, entities must actively search for compromise indicators, such as specific database errors in log files, to mitigate the risks of these vulnerabilities.
