Active Zero-Day Attacks Chain Auth Bypass and Dynamic Class Loading in PaperCut NG/MF
PaperCut Software has issued an urgent advisory warning of zero-day exploitation against its PaperCut NG and PaperCut MF print management software. The attacks target internet-exposed Application Servers across all versions of the software. Threat actors are chaining two distinct vulnerabilities: `CVE-2026-81578`, an improper access control flaw in the web management interface, and `CVE-2026-82078`, an unsafe dynamic class loading issue in the database connection utilities. Together, these flaws allow unauthenticated remote attackers to modify system configurations and execute arbitrary Java bytecode. Security researchers at Huntress observed limited in-the-wild exploitation involving base64-encoded reconnaissance commands, such as `whoami` and `ver`, spawned from the primary application process `pc-app.exe`. PaperCut initially released a fix based on telemetry from an impacted university customer, but subsequently published an updated Emergency Patch (Release 2) following collaborative analysis with Huntress and watchTowr. The vendor strongly urges administrators to immediately restrict web interface access using network access controls or firewalls. Key indicators of compromise include missing or truncated `server.log` files and specific log entries such as `ERROR No suitable driver found for jdbc:no:x` or `ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST`. Administrators are instructed to apply Release 2 immediately, even if the initial emergency patch was already deployed.
Commentary
PaperCut application servers remain a premier target for initial access brokers and ransomware syndicates—echoing the widespread exploitation of `CVE-2023-27350` by Clop and LockBit affiliates in 2023. Any organization running PaperCut MF or NG must assume risk, especially considering Shadowserver telemetry showing roughly 1,000 instances directly exposed to the public internet. Organizations should immediately isolate PaperCut web interfaces behind a VPN, reverse proxy, or strict IP allowlist; there is almost no operational justification for a print management administrative console to listen on public subnets. Beyond immediate patching to Emergency Patch Release 2, incident response teams should inspect process lineage around `pc-app.exe` (specifically checking for child processes like `cmd.exe` or `powershell.exe`) and grep `server.log` for JDBC driver loading anomalies. Missing or zero-byte log files should immediately trigger a full host triage.
The Quote to Remember
“If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses)”
“Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch”