New research from watchTowr shows that PaperCut’s emergency fixes for an actively exploited flaw chain were bypassed repeatedly, and that one interim build was still open to a fresh unauthenticated takeover. Any PaperCut NG or MF server that stopped at the August emergency patches should be moved to a fully fixed release and checked for signs of compromise.
What happened
On 9 October 2026, watchTowr Labs published research on the PaperCut NG and MF print management platform, starting from a zero-day that PaperCut disclosed on 27 August. At that point attackers were already compromising servers and PaperCut could offer only indicators of compromise and mitigations.
The attack chained two bugs. CVE-2026-81578 is an authentication bypass in the web management interface, scored 8.8, and CVE-2026-82078 is an unsafe class-loading weakness in the database connection code, scored 9.4. Together they give an unauthenticated attacker code execution on the Application Server. CISA added both to its Known Exploited Vulnerabilities catalogue on 31 August and set US federal agencies a deadline of 14 September.
According to watchTowr’s timeline, its researchers reproduced the in-the-wild chain by diffing PaperCut’s first patch, then found ways around it. PaperCut shipped a second emergency build, 26.0.4 build 76508, on 28 August. watchTowr reported a bypass of that fix the same day, and PaperCut closed it in build 76530 on 1 September. A separate post-authentication code execution bug in the scan-to-fax feature, now CVE-2026-82077, was found on 31 August and was only fixed in 26.0.5 on 10 September. watchTowr says that combining the scan-to-fax bug with the third authentication bypass produced a complete unauthenticated remote code execution chain against build 76508, a build PaperCut had issued as an emergency fix. The firm’s editor summed up the sequence as “patch hell”.
Huntress, which also worked with PaperCut during the incident, told BleepingComputer that it had found patch bypasses and an additional authentication bypass of its own. It saw exploitation in two customer environments.
The technical picture
The root cause of the original bypass sits in how PaperCut’s web interface handles the Apache Tapestry framework. Tapestry lets one request name a page to render and a separate page whose component handles the action. PaperCut’s permission check ran against the page being displayed, not the page doing the work. A request could therefore show a harmless public page while quietly firing an administrative function behind it.
The second half of the chain abuses the external card-number lookup feature. SonicWall’s Capture Labs analysis explains that the server loaded whichever database driver and connection string the configuration specified, with no allowlist. Because the first bug lets an outsider rewrite that configuration, the database connection itself becomes the route to running commands. On version 26 this happens in memory, without writing files to disk. PaperCut’s final fix does not try to sanitise the connection string. Instead it puts the lookup feature behind a new setting that is switched off by default.
The later bypasses followed the same pattern. Each fix tightened the check that had just been abused, and the researchers then found another page or form, including parts of the initial setup wizard, that the check did not cover. The lesson for defenders is that partial fixes left real exposure.
PaperCut also put several separate bypasses under the original CVE identifiers, so CVE numbers on their own do not tell you whether a server is safe. The versions that fix both original CVEs are 24.1.10, 25.0.13 and 26.0.5. watchTowr names 26.0.5 as the fix for CVE-2026-82077.
Why it matters for UK organisations
watchTowr describes PaperCut’s user base as including schools, universities, healthcare providers, government bodies, law firms and businesses of every size. Those sectors loom large in the UK and often run lean IT teams. Print servers often fall between infrastructure and desktop teams, so they get patched late.
There is precedent here. Attacks on the 2023 PaperCut flaws, notably CVE-2023-27350, were linked to several groups, including the Clop and LockBit ransomware operations and Iranian state-backed actors, as BleepingComputer has recorded. This time, watchTowr’s head of threat intelligence, Jake Knott, told SecurityWeek in early September that activity had moved from scanning to hands-on-keyboard intrusions. He said the behaviour resembled initial access brokers, and that the attackers were locking their in-memory implants so that only they could reuse them. His warning was blunt: exposed servers left unpatched at any point should be “assumed compromised by an active attacker”. Shadowserver data cited by SecurityWeek put internet-exposed PaperCut NG/MF instances at more than 1,000.
A PaperCut Application Server usually holds directory integration credentials, card and user mappings, and network reach into print infrastructure across the estate. It is an excellent foothold for lateral movement.
Expert view
This episode shows why I am cautious with emergency patches for actively exploited flaws. A vendor under pressure ships a narrow fix for the exact path it has seen abused. Capable researchers, and capable attackers, then diff that fix and look sideways for the same mistake elsewhere. Here that took hours, not weeks. In my experience, organisations treat the first emergency patch as the end of the job. It should be treated as a stopgap until the proper maintenance release ships.
The second lesson is about exposure. When we test estates, management interfaces for back-office applications are among the things we most often find reachable from places they should not be, sometimes directly from the internet. PaperCut’s own guidance is to restrict the web interface to trusted addresses. That control would have blunted every stage of this chain, patched or not.
Patching closes the door to new intruders but does nothing about anyone already inside. Because exploitation started before any fix existed, every exposed server needs a compromise assessment as well as an upgrade.
What to do now
- Confirm your version. Upgrade PaperCut NG/MF Application Servers to 24.1.10, 25.0.13 or 26.0.5 or later. Do not rely on 26.0.4 emergency builds. PaperCut also advises updating site servers and secondary print servers. This maps to the Cyber Essentials security update management control.
- Restrict the admin interface. Limit access to the web management port (TCP 9191 by default) to named administrative hosts or networks using firewall rules, and remove any direct internet exposure. This is the Cyber Essentials firewall control in practice.
- Hunt before you relax. Review server logs from late August onwards against PaperCut’s published indicators. Look for database lookup errors that reference unexpected drivers, missing or truncated log files, and unusual child processes or outbound connections from the PaperCut service.
- Check the lookup feature. After upgrading, make sure the external card-number lookup stays disabled unless you genuinely need it.
- Rotate secrets. If compromise cannot be ruled out, rotate directory service accounts and any credentials stored in PaperCut, and invoke your incident response plan.
- Segment print infrastructure. Isolate print management servers from sensitive internal systems and apply egress filtering so a compromised host cannot easily call out.
Bottom line
PaperCut moved quickly, but its first fixes were incomplete, and one emergency build remained open to unauthenticated takeover. Any UK organisation that applied the August emergency patch and stopped there should move to a fixed maintenance release, lock down the admin interface and look hard for signs that someone got in first.
Sources
- watchTowr Labs: Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses)
- BleepingComputer: PaperCut releases second emergency patch for exploited flaws
- SecurityWeek: PaperCut exploitation escalates to active intrusions
- SonicWall Capture Labs: PaperCut NG/MF Unauthenticated RCE Chain
