PaperCut NG/MF Zero-Day RCE Chain: CVSS 9.4, Actively Exploited, Now in CISA KEV
What's Happening
CISA has added both PaperCut NG/MF vulnerabilities from the zero-day emergency that began on 27 August, CVE-2026-81578 and CVE-2026-82078, to its Known Exploited Vulnerabilities catalog on evidence of active exploitation, with federal agencies required to patch by 14 September. The two flaws chain into unauthenticated remote code execution. CVE-2026-81578 (CVSSv4 8.8) is an authentication bypass in the web management interface; CVE-2026-82078 (CVSSv4 9.4) is unsafe dynamic class loading in the database connector.
The bypass abuses the Apache Tapestry framework's "complex direct" request format: the attacker nominates a public page (Error, Exception, or Home) for display while invoking administrative components belonging to ConfigEditor or UserList. PaperCut validates access only for the displayed page, so the administrative components execute unauthenticated. The attacker then rewrites four external user-lookup settings (db-driver, db-url, id-to-username-sql, enabled) to point at a malicious JDBC connection and crafted SQL, then triggers a user search that executes it. Via the bundled Derby driver and H2's INIT mechanism, that SQL creates a JavaScript-backed trigger running on the Nashorn engine, which starts an operating-system process. Remote code execution with no credentials and no user interaction.
PaperCut has confirmed customer incidents; a university security team and its DFIR firm supplied the evidence that let the vendor reproduce the chain. A Metasploit module is now public.
Why This Matters Now
Exploitation is confirmed in the wild, and public weaponization lowers the skill floor by the hour. The patch situation compounds this: the first emergency patch released on 28 August was itself bypassable using the Home page variant, so PaperCut shipped Emergency Patch Release 2 for versions 24, 25, and 26 on Windows, Linux, and macOS. Any organisation that applied only the first patch is not protected and must re-patch. PaperCut treats all NG and MF versions as potentially affected, so older releases need an upgrade path, not a hotfix. And the precedent is bad: the 2023 PaperCut flaw CVE-2023-27350 was mass-exploited by ransomware operators. Print management servers sit across enterprise, education, and healthcare estates, chronically under-patched and frequently internet-exposed.
For detection, watch for unauthenticated POSTs to /app?service=direct/ URIs referencing ConfigEditor or UserList, alerts involving post-exploitation behaviour around pc-app.exe, missing or truncated server.log files, and the log signatures "No suitable driver found for jdbc" and "DatabaseUtils - Database error looking up cardID".
So What / Action
Inventory every PaperCut NG/MF Application Server, including instances behind VPNs and across education and healthcare estates. Apply Emergency Patch Release 2 immediately to anything internet-facing, and treat anyone patched with Release 1 as unpatched. Where patching is delayed, restrict web access to trusted internal IP ranges using firewall rules or a reverse proxy. Verify the four user-lookup settings have not been tampered with, and check server.log integrity on every server exposed since 27 August. For confirmed exposure, run forensic triage: with a KEV listing and public exploit tooling, treat the server as compromised until proven otherwise.