PaperCut customers are dealing with an actively exploited zero-day chain that can let attackers move from an exposed print-management web interface to code execution on the PaperCut Application Server, then install remote-access tooling on compromised systems.
The company first warned customers on August 27, 2026 that it was investigating confirmed incidents affecting PaperCut NG and PaperCut MF. By August 28, PaperCut had identified two vulnerabilities, released a second emergency patch with additional hardening, and urged customers to install that second release even if they had already applied the initial emergency update. CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31.
The useful way to think about this incident is not as a printer problem. PaperCut Application Servers often sit near identity systems, print queues, multifunction devices, document workflows, and internal networks. If the web interface is reachable from the public internet, the server can become a practical entry point for reconnaissance, remote administration tools, and later movement.
The Two-Flaw Chain
The first vulnerability, CVE-2026-81578, is an authentication-bypass flaw in the PaperCut NG/MF web management interface. PaperCut describes it as a missing-authentication issue that can allow unauthenticated remote requests to trigger backend administrative actions before access checks finish. In practical terms, an attacker may be able to change certain system settings without logging in.
The second vulnerability, CVE-2026-82078, is an unsafe dynamic class-loading flaw in the database connection utilities. PaperCut says the application loaded database driver classes from configurable driver names without validating them against an approved allowlist. If an attacker can manipulate those configuration parameters, the flaw can lead to arbitrary Java bytecode execution under the PaperCut server process.
That sequencing matters. CVE-2026-81578 supplies the unauthenticated configuration access; CVE-2026-82078 turns manipulated configuration into execution. Huntress, which investigated observed intrusions and reproduced the chain, says the two flaws together enable pre-authentication remote code execution against the PaperCut Application Server.
What Attackers Have Been Doing
Early observed activity looked like system discovery rather than immediate ransomware deployment. Huntress reported two customer environments with exploitation evidence and found commands that decoded to basic reconnaissance such as whoami & ver and, in another case, whoami & ver & tasklist. The company also recovered Java class-file artifacts from PaperCut logs, including payload behavior that could run commands on Windows or Linux and then delete evidence after execution.
PaperCut later expanded its indicators of compromise with a fuller command sequence observed in environments where execution was not stopped. According to Help Net Security’s summary of the vendor update, attackers enumerated users, privileges, running processes, domain controllers, and logged-on sessions before downloading a payload from a file-sharing host into C:\ProgramData. The activity included installation of SimpleHelp remote access software and a later AnyDesk download as a second access channel.
That progression should shape response. A vulnerable PaperCut server that was exposed to the internet should not be treated as clean just because the emergency patch installs successfully. The first question is whether the server was reachable, whether the PaperCut process spawned shells or system tools, and whether legitimate remote-access software appeared where it does not belong.
What To Patch And Isolate
PaperCut’s current guidance is to apply Emergency Patch Release 2 for supported major versions 24, 25, and 26. Customers running older unsupported releases should upgrade to a supported major version and then apply the emergency patch path. PaperCut also says Site Servers and secondary or print servers need to be updated, not only the primary Application Server. Print Deploy and Mobility Print are not affected by these two vulnerabilities.
Network exposure needs to be handled immediately, even before a full change window is finished. PaperCut has told customers to restrict the Application Server web interfaces to trusted IP addresses using firewall rules, network access controls, VPN access, or equivalent controls. A public PaperCut management interface should be treated as an emergency exposure, not a convenience feature.
- Install Emergency Patch Release 2 for PaperCut NG/MF 24, 25, or 26.
- Upgrade older unsupported installations instead of waiting for fixes for v23 or earlier.
- Patch Site Servers and secondary or print servers where deployed.
- Restrict PaperCut web administration access to trusted networks only.
- Preserve logs and endpoint evidence before restarting, rebuilding, or making broad cleanup changes.
What To Hunt For
PaperCut’s own indicators include intrusion-detection, endpoint-security, or network-monitoring alerts involving the Application Server, especially suspicious post-exploitation behavior from pc-app.exe or pc-app. Missing, unexpectedly truncated, or deleted PaperCut server.log files are also important, because observed payloads attempted to remove traces after execution.
Administrators should review server.log for strings such as ERROR No suitable driver found for jdbc:no:x, ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST, DB URL: jdbc:derby:memory:pwn;create=true, and entries involving VALUES CAST(X'cafebabe. PaperCut has also flagged unexpected class files under <install>\server\lib\<5-char-name>.class and command or output files under <install>\server\data\content\.
Process telemetry can be just as important as application logs. Look for pc-app.exe spawning cmd.exe, whoami, ver, tasklist, nltest, quser, file-download utilities, or remote-access installers. PaperCut has specifically advised checking for a Windows service named Remote Access Service running SimpleService.exe from a C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\ path, along with unexpected AnyDesk installations.
When A Patch Is Not Enough
For a server that was internet-facing during the exploitation window, the safer incident-response path starts with evidence preservation. Save PaperCut logs, process-tree data, firewall and reverse-proxy logs, DNS and network-flow records, file-creation timestamps, scheduled tasks, autoruns, and current configuration before the system is changed. Once remote-access tooling is suspected, response should include credential review, lateral-movement checks, and validation that no unattended access remains.
PaperCut’s guidance for suspected compromise is stronger than a normal patch-and-monitor recommendation: secure current server backups, wipe and rebuild the Application Server, restore a clean backup from before suspicious activity, and activate the organization’s incident-response process. That is sensible for a server where attackers may have had code execution and may have installed remote administration software.
The remaining unknown is motive. PaperCut, Huntress, and other responders have described exploitation and tooling, but public reporting has not yet tied the campaign to a named actor or a final objective. Given PaperCut’s 2023 history as a ransomware target, the absence of a named ransomware payload should not lower urgency. The immediate job is to close exposure, patch every affected server, and prove that the print-management layer did not become a quiet access path into the rest of the network.
