# Critical Security Flaws Discovered in PaperCut Software Authentication bypass vulnerabilities enable remote code execution. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6fafe59a-4446-4294-893c-9ccf867fb90e ## Vulnerability Discovery Researchers identified critical flaws in PaperCut NG and MF software that allow unauthenticated requests to modify server configurations. Huntress experts revealed these vulnerabilities could enable malicious actors to execute arbitrary Java code within the application process. The vulnerability occurs when rendering one page while executing unauthorized components in the background, bypassing proper authorization checks. ## Chained Exploitation watchTowr reported attackers combining CVE-2026-81578 and CVE-2026-82078 vulnerabilities. The first flaw bypasses authentication while the second enables remote code execution. Researcher Jake Knott emphasized this combination provides complete system control. The company also discovered multiple patch bypass methods and additional authentication vulnerabilities, with some addressed in the second emergency patch. ## Attack Techniques Attackers execute Base64-encoded commands to identify user accounts and operating systems. OS-agnostic Java .class files run commands on both Linux and Windows systems, writing system information to 'Udydn.out' before deleting it along with log files. In an August 27, 2026 incident, attackers used a modified .class file version that also listed running processes, indicating evolving attack methods. ## Affected Systems All organizations running outdated PaperCut NG and MF versions are at risk, particularly internet-exposed servers. Huntress observed limited exploitation in two customer environments, with attackers conducting reconnaissance activities. The attacks appear focused on gathering system information during initial compromise stages, suggesting potential follow-on activities. ## Immediate Actions Experts recommend immediately restricting PaperCut server internet access and applying emergency patches. Configuring access only from trusted IPs or behind VPNs is critical. Monitoring log files for 'Database error looking up cardID' entries can help detect compromises. While the second patch addresses some bypass methods, new techniques affecting fully patched versions have emerged. ## Vendor Response Australia-based PaperCut released a second emergency patch with additional hardening measures beyond the initial fix. The company hasn't shared details about active exploitation. Huntress researcher John Hammond stated insufficient evidence exists to determine attacker end goals, but observed activities resemble early-stage reconnaissance typical of network intrusion attempts. ## Industry Impact As widely deployed enterprise software, PaperCut presents significant risks. Knott highlighted its dual threat as both network entry point and sensitive data repository for printed documents. High-security sectors like finance, healthcare, and government face particularly severe threats. The vulnerabilities' chaining potential increases attack effectiveness against vulnerable implementations. ## Long-term Solutions Cybersecurity professionals urge organizations to strengthen defenses before AI-powered attacks accelerate. Enhancing vulnerability management, risk prioritization, and anomaly detection systems is crucial. Continuous monitoring and threat hunting for internet-exposed critical systems becomes increasingly important as attack techniques evolve and become more sophisticated. ## Sources covering this story - https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._