Critical Security Flaws Discovered in PaperCut Software
Authentication bypass vulnerabilities enable remote code execution.
1Vulnerability Discovery
Researchers identified critical flaws in PaperCut NG and MF software that allow unauthenticated requests to modify server configurations. Huntress experts revealed these vulnerabilities could enable malicious actors to execute arbitrary Java code within the application process. The vulnerability occurs when rendering one page while executing unauthorized components in the background, bypassing proper authorization checks.
2Chained Exploitation
watchTowr reported attackers combining CVE-2026-81578 and CVE-2026-82078 vulnerabilities. The first flaw bypasses authentication while the second enables remote code execution. Researcher Jake Knott emphasized this combination provides complete system control. The company also discovered multiple patch bypass methods and additional authentication vulnerabilities, with some addressed in the second emergency patch.
3Attack Techniques
Attackers execute Base64-encoded commands to identify user accounts and operating systems. OS-agnostic Java .class files run commands on both Linux and Windows systems, writing system information to 'Udydn.out' before deleting it along with log files. In an August 27, 2026 incident, attackers used a modified .class file version that also listed running processes, indicating evolving attack methods.
4Affected Systems
All organizations running outdated PaperCut NG and MF versions are at risk, particularly internet-exposed servers. Huntress observed limited exploitation in two customer environments, with attackers conducting reconnaissance activities. The attacks appear focused on gathering system information during initial compromise stages, suggesting potential follow-on activities.
5Immediate Actions
Experts recommend immediately restricting PaperCut server internet access and applying emergency patches. Configuring access only from trusted IPs or behind VPNs is critical. Monitoring log files for 'Database error looking up cardID' entries can help detect compromises. While the second patch addresses some bypass methods, new techniques affecting fully patched versions have emerged.
6Vendor Response
Australia-based PaperCut released a second emergency patch with additional hardening measures beyond the initial fix. The company hasn't shared details about active exploitation. Huntress researcher John Hammond stated insufficient evidence exists to determine attacker end goals, but observed activities resemble early-stage reconnaissance typical of network intrusion attempts.
7Industry Impact
As widely deployed enterprise software, PaperCut presents significant risks. Knott highlighted its dual threat as both network entry point and sensitive data repository for printed documents. High-security sectors like finance, healthcare, and government face particularly severe threats. The vulnerabilities' chaining potential increases attack effectiveness against vulnerable implementations.
8Long-term Solutions
Cybersecurity professionals urge organizations to strengthen defenses before AI-powered attacks accelerate. Enhancing vulnerability management, risk prioritization, and anomaly detection systems is crucial. Continuous monitoring and threat hunting for internet-exposed critical systems becomes increasingly important as attack techniques evolve and become more sophisticated.
Original article: The Hacker News — PaperCut Yazılımında Kritik Güvenlik Açıkları