#papercut

Active Zero-Day Attacks Chain Auth Bypass and Dynamic Class Loading in PaperCut NG/MF

PaperCut Software has issued an urgent advisory warning of zero-day exploitation against its PaperCut NG and PaperCut MF print management software. The attacks target internet-exposed Application Servers across all versions of the software. Threat actors are chaining two distinct vulnerabilities: `CVE-2026-81578`, an improper access control flaw in the web management interface, and `CVE-2026-82078`, an unsafe dynamic class loading issue in the database connection utilities. Together, these flaws allow unauthenticated remote attackers to modify system configurations and execute arbitrary Java bytecode. Security researchers at Huntress observed limited in-the-wild exploitation involving base64-encoded reconnaissance commands, such as `whoami` and `ver`, spawned from the primary application process `pc-app.exe`. PaperCut initially released a fix based on telemetry from an impacted university customer, but subsequently published an updated Emergency Patch (Release 2) following collaborative analysis with Huntress and watchTowr. The vendor strongly urges administrators to immediately restrict web interface access using network access controls or firewalls. Key indicators of compromise include missing or truncated `server.log` files and specific log entries such as `ERROR No suitable driver found for jdbc:no:x` or `ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST`. Administrators are instructed to apply Release 2 immediately, even if the initial emergency patch was already deployed.