PaperCuts Print Server Has a Pre-Auth RCE Chain, and Attackers Found It First

PaperCut print management software sits quietly in the background of thousands of schools, councils, hospitals and offices, tracking who printed what and billing departments for the privilege. That obscurity is exactly why the vulnerability disclosed this week matters: nobody watches a print server the way they watch a mail gateway, and attackers know it.

Whats actually broken

PaperCuts advisory names two flaws. CVE-2026-81578 is an improper access control bug in the web management interface. Send the right request without logging in, and you can rewrite the servers own configuration. CVE-2026-82078 is nastier, an unsafe dynamic class-loading issue in the database connection utilities, which lets that same unauthenticated request load and execute arbitrary Java bytecode.

Neither flaw alone is catastrophic. Chained together, they hand an attacker pre-authentication remote code execution on the PaperCut Application Server itself. From there its the usual playbook, drop a webshell, pivot into the wider network, and print servers often have far more internal reach than their job title suggests.

Why this one moves fast

PaperCut published the advisory saying it was already investigating active exploitation, which means the CVE numbers came after attackers, not before. That ordering matters. Its the same pattern that made the last PaperCut incident in 2023 a headline, a plain piece of infrastructure exploited quietly for weeks before defenders noticed.

Print servers rarely get the patching urgency of an internet-facing web app, but PaperCut NG and MF often run with database credentials and directory integration that make them a genuinely useful foothold. Treat this the way youd treat a VPN appliance bug, not a nice-to-have update.

What to do

If you run PaperCut NG or MF, check the vendors security bulletin for your version and patch immediately. If patching cant happen today, restrict access to the web management interface to trusted internal networks only, it should never be reachable from the open internet in the first place. Then check logs for unexpected configuration changes or unfamiliar processes spawned by the PaperCut service account, since the exploitation window may already have opened before the advisory landed.

For IT teams managing a fleet of shared devices, this is also a good prompt to audit which plain internal services are reachable from outside the firewall. Print servers, backup consoles and monitoring dashboards get forgotten in exactly the way that made this bug dangerous.