# PaperCuts print server has a pre-auth RCE chain, and attackers found it first

> Two chained flaws in PaperCut NG and MF let an unauthenticated attacker take over the application server. Active exploitation is already underway.

- Published: 2026-09-04
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/papercut-ng-mf-zero-day-rce-2026/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- CVE-2026-81578 lets an unauthenticated attacker change PaperCut system configuration through the web management interface
- CVE-2026-82078 turns database connection settings into a path for loading arbitrary Java bytecode
- Chained together the two flaws give pre-authentication remote code execution on the PaperCut Application Server
- PaperCut confirmed active exploitation before assigning either CVE, so assume attackers had a head start

## Article

PaperCut print management software has a pre-authentication remote code execution chain, and attackers were using it before the CVE numbers existed. Two flaws in PaperCut NG and MF, tracked as CVE-2026-81578 and CVE-2026-82078, let an unauthenticated attacker take over the application server. PaperCut says active exploitation is already underway.

The software sits quietly in the background of thousands of schools, councils, hospitals and offices, tracking who printed what and billing departments for the privilege. That obscurity is exactly why the disclosure matters: nobody watches a print server the way they watch a mail gateway, and attackers know it.

## What is actually broken in PaperCut NG and MF?

PaperCut's advisory names two flaws. CVE-2026-81578 is an improper access control bug in the web management interface. Send the right request without logging in, and you can rewrite the server's own configuration.

CVE-2026-82078 is nastier. It is an unsafe dynamic class-loading issue in the database connection utilities. Class loading is how Java pulls compiled code (bytecode) into a running application, so an attacker who controls what gets loaded controls what runs. Here, the same unauthenticated request can make the server load and execute arbitrary Java bytecode.

Neither flaw alone is catastrophic. The first lets an outsider change settings, including the database connection settings, and the second turns those settings into a route for running code. Chained together, they hand an attacker pre-authentication remote code execution on the PaperCut Application Server itself.

### How the two bugs fit together

| Step | Flaw | What the attacker gains |
|---|---|---|
| 1 | CVE-2026-81578, improper access control in the web management interface | Rewrites system configuration without logging in |
| 2 | CVE-2026-82078, unsafe dynamic class loading in database connection utilities | Loads and runs arbitrary Java bytecode |
| 3 | Both chained | Pre-authentication remote code execution on the Application Server |

From that point it is the usual playbook: drop a webshell (a small script that gives remote control through a web page), then pivot into the wider network. Print servers often have far more internal reach than their job title suggests.

## Why did attackers get there first?

PaperCut published the advisory saying it was already investigating active exploitation. That means the CVE numbers came after the attackers, not before. Huntress has also published an advisory on the exploitation, and PaperCut's own security bulletin carries the vendor's guidance.

That ordering matters because defenders normally work from a disclosure date. When exploitation precedes the advisory, there is a window in which a server could have been compromised with no public warning. Anyone running PaperCut should assume that window may already have been used.

It is the same pattern that made the last PaperCut incident, in 2023, a headline: a plain piece of infrastructure exploited quietly for weeks before defenders noticed. Attackers have not stopped looking at this product since.

## Why do print servers make such a good foothold?

Print servers rarely get the patching urgency of an internet-facing web application. They are treated as appliances, installed once and left alone. Yet PaperCut NG and MF often run with database credentials and directory integration, which makes them a genuinely useful foothold.

Directory integration means the server knows about users and groups across the organisation. Database credentials mean a way into stored records. An attacker who lands on the box gets both without needing to phish anyone.

Automation is making this kind of target more attractive. We covered how [one threat actor used hundreds of AI agents to compromise print servers](/article/ai-agents-papercut-exploit-440-servers/), which shows how quickly a reachable, unpatched PaperCut instance gets found once a flaw is known.

## What should you do if you run PaperCut?

Check the vendor's security bulletin for your version and patch immediately. Treat this the way you would treat a VPN appliance bug, not a nice-to-have update.

If patching cannot happen today, restrict access to the web management interface to trusted internal networks only. It should never be reachable from the open internet in the first place.

Then look for signs that the exploitation window has already opened:

- Unexpected changes to system configuration or database connection settings.
- Unfamiliar processes spawned by the PaperCut service account.
- New files in web-served directories, which can indicate a webshell.
- Unusual outbound connections from the print server.

Patching does not remove an attacker who is already inside, so a clean patch level is not proof of a clean server. If anything on that list turns up, treat the host as compromised and rebuild it.

### How to harden the server beyond the patch

A patch closes these two holes, but it does not make the server a good place to keep secrets. Give the database account that PaperCut uses only the permissions it needs, so a hijacked service cannot read or change unrelated data. Do the same for the directory account, using a read-only service identity where the product allows it.

Put the Application Server on a network segment of its own, so a compromise cannot reach file servers or domain controllers directly. Keep the management interface behind a VPN or jump host, and make sure monitoring covers the print server as well as the web-facing estate. Most of the damage from an attack like this comes from what the compromised server is allowed to talk to, not from the server itself.

### Where this fits among other exploited flaws

This is not an isolated case. Attackers are weaponising flaws in edge and infrastructure software faster than many teams can respond, which is why [CISA cut the patch window to three days](/article/cisa-three-day-patch-window/) for flaws it lists as exploited. Our roundup of [actively exploited CVEs from September 2026](/article/actively-exploited-cve-september-2026/) shows how crowded that list has become.

For IT teams managing a fleet of shared devices, this is also a prompt to audit which plain internal services are reachable from outside the firewall. Print servers, backup consoles and monitoring dashboards get forgotten in exactly the way that made this bug dangerous. A quick scan of your external address space, followed by closing anything that has no business being public, costs far less than an incident response.

## What happens next?

Expect more detail on the exploitation to emerge as PaperCut and security firms such as Huntress continue their investigations. The details of who is behind the attacks and what they are doing after getting in have not been confirmed in the advisories.

What is already clear is the shape of the risk. Two modest-looking bugs, one about who is allowed to change settings and one about what code a database utility may load, combine into full server takeover. Check your version, shut the management interface off from the internet, and read the logs.

## Key takeaways

- CVE-2026-81578 lets an unauthenticated attacker change PaperCut system configuration through the web management interface.
- CVE-2026-82078 turns database connection settings into a path for loading arbitrary Java bytecode.
- Chained together, the two flaws give pre-authentication remote code execution on the PaperCut Application Server.
- PaperCut confirmed active exploitation before assigning either CVE, so assume attackers had a head start.
- Patch PaperCut NG and MF immediately, or restrict the web management interface to trusted internal networks if you cannot patch today.

## Sources

- [PaperCut Security Bulletin](https://www.papercut.com/kb/Main/SecurityBulletin)
- [Huntress PaperCut Advisory](https://www.huntress.com/blog/papercut-actively-exploited)