PaperCut Software has issued a crucial second emergency patch to address newly discovered zero-day vulnerabilities in its NG and MF print management software. These vulnerabilities have been actively exploited, prompting the company to enhance its security measures.
Details of the Vulnerability Exploits
Unauthenticated attackers can leverage these zero-day vulnerabilities to bypass authentication mechanisms and execute remote code on compromised PaperCut NG/MF systems. The initial security advisory was released by PaperCut on August 27, followed by a first emergency patch the subsequent day. A second patch was also released to provide further security reinforcements, extending support to version 24 and offering indicators of compromise (IoCs).
Earlier assumptions suggested a single vulnerability was exploited; however, PaperCut, along with security firms Huntress and WatchTowr, confirmed that two distinct zero-days were targeted. The first, CVE-2026-81578, is a high-severity flaw that enables unauthenticated remote attackers to alter system configurations. The second, CVE-2026-82078, involves unsafe dynamic class loading, posing critical risks.
Security Measures and Discoveries
PaperCut’s advisory elaborated on the potential consequences of these exploits, emphasizing the risk of arbitrary Java bytecode execution within the security context of the server process. The company is actively working on an official patch to address both vulnerabilities fully.
WatchTowr identified multiple patch bypasses and an additional authentication flaw, which necessitated the release of the second emergency patch. Huntress reported observing early exploitation attempts as of August 26, indicating system reconnaissance activities, though no secondary malware or persistent threats have been detected so far.
Current Impact and Outlook
The identity and motives of the threat actors exploiting these zero-days remain unknown. However, the exploitation of vulnerabilities in PaperCut NG/MF is not unprecedented, as highlighted by CISA’s Known Exploited Vulnerabilities catalog, which lists similar past incidents, including ransomware attacks.
According to ShadowServer Foundation data, around 1,000 PaperCut instances are exposed online, primarily in North America and Europe. Cybersecurity stakeholders urge vigilance and recommend all users apply the latest patches to safeguard their systems against potential attacks.
As the situation develops, PaperCut continues to update stakeholders and works towards a comprehensive fix for the identified security flaws. Users are advised to stay informed and apply security updates promptly to mitigate risks.
