An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut…

CVE-2026-81578 is an authentication bypass in the web management interface of PaperCut MF and PaperCut NG, all versions prior to the Aug 27, 2026 emergency patches. The flaw abuses Apache Tapestry's "complex direct" request format: an attacker crafts a request that renders one (unauthenticated) page while silently executing administrative components from another page. The server's authorization logic trusts the rendered page and never checks permissions on the backend action. On its own this grants unauthenticated configuration modification — but when chained with CVE-2026-82078 (unsafe dynamic class-loading in JDBC driver instantiation, CVSS 9.4), the result is pre-authentication remote code execution as SYSTEM. Every version of PaperCut MF and NG ever shipped is affected. Emergency patches exist for versions 24, 25, and 26, but roughly 47% of tracked installations run v23 or older with no patch available.

There is no official vendor CVSS for CVE-2026-81578; third-party trackers assign 8.8 (High). That label drastically understates reality. This vulnerability is actively exploited as a zero-day — Huntress confirmed compromise in two customer environments within hours of disclosure, with full SYSTEM-level code execution reproduced in under two minutes. The initial emergency patch was bypassed the same day; a second hardened patch followed on Aug 28. watchTowr researchers have identified additional bypasses affecting even the latest patch. Treating this as merely HIGH ignores the live exploitation, the trivial attack chain, and the fragile patch posture. This is CRITICAL by any operational definition.

Why this verdict

• Pre-auth, zero-friction chain: CVE-2026-81578 requires no credentials, no user interaction, and no special configuration. A single HTTP request bypasses authentication. Chained with CVE-2026-82078, the attacker achieves SYSTEM-level RCE. No downward adjustment warranted for friction — there is none.
• Active zero-day exploitation: Huntress confirmed compromise in two customer environments within hours of disclosure. Exploitation is trivial and reproducible. This alone floors the verdict at CRITICAL regardless of other factors.
• Fragile patch posture: The first emergency patch was bypassed within hours. Emergency Patch Release 2 includes "additional hardening" but watchTowr has identified further bypasses. 47% of installations run v23 or older with no patch available at all.
• Role multiplier: PaperCut NG/MF is a print management server — typically a line-of-business server (category b). However, it commonly authenticates against Active Directory via LDAP and stores AD service account credentials. SYSTEM access on the PaperCut host yields these credentials, enabling lateral movement to domain controllers. In AD-integrated deployments (the majority of enterprise installs), the blast radius extends from host → domain. With ~70K organizations and 100M+ users globally, the installed base is substantial. The chain succeeds regardless of deployment role. Floor: CRITICAL based on the domain-escalation path in typical enterprise deployments combined with active exploitation.
• Broad exposure surface: ~1,000 instances are internet-facing per ShadowServer. All internal instances are also vulnerable from any network position that can reach port 9191/9192. The 100% affected version range means every PaperCut server is a target.

Why not higher?

The score is already at the top of the CRITICAL range. A 10.0 would require a self-propagating worm or supply-chain compromise affecting all downstream consumers. While severe, this chain requires per-target exploitation and does not self-propagate.

Why not lower?

Every downgrade factor fails here. There is no authentication requirement (pre-auth). There is no user interaction requirement. There is no narrow version range (all versions affected). There is active exploitation. The process runs as SYSTEM. Patch bypasses exist. Downgrading below CRITICAL would be negligent given confirmed zero-day exploitation of a frictionless RCE chain.

1. Block external access to PaperCut web ports (9191/9192) immediately — The most impactful control — eliminates the internet-facing attack surface entirely. Deploy firewall rules within hours. Even internal exploitation requires network access to these ports, so restricting to admin VLANs reduces blast radius. Under noisgate mitigation SLA for CRITICAL, deploy within 3 days — but given active exploitation, do this today.
2. Apply Emergency Patch Release 2 for PaperCut NG/MF v24, v25, v26 — Install the latest emergency patches (Aug 28 build). Be aware that patch bypasses have been reported — this is defense-in-depth, not a complete fix. Monitor PaperCut's advisory page for Release 3. Under noisgate remediation SLA, complete within 90 days — but given active exploitation, patch within 72 hours.
3. Deploy WAF rules blocking Tapestry direct-service request patterns — Block HTTP requests matching /app?service=direct/ with component references to ConfigEditor, UserList, or QuickFind. This catches the known exploit paths and buys time while patches stabilize.
4. Monitor PaperCut server for IOCs — Check for: unexpected .class files in server/lib/, files in server/data/content/ with .cmd/.out extensions, log entries containing jdbc:derby:memory:pwn or No suitable driver found for jdbc:no:x, deleted/truncated server.log files, and child processes of pc-app.exe (cmd.exe, powershell.exe, whoami.exe).
5. Rotate AD service account credentials used by PaperCut — If PaperCut authenticates against AD (common in enterprise), assume the LDAP bind credentials stored on the server are compromised if any exploitation IOCs are found. Rotate immediately and audit the service account's permissions.
6. Isolate PaperCut servers on a dedicated VLAN with egress filtering — Limit the PaperCut server's ability to reach other internal systems. Deny outbound SMB, LDAP, and RDP to non-essential hosts. This constrains lateral movement if the server is compromised.

Run this script on each PaperCut NG/MF Application Server host (Linux or macOS) as any user with read access to the PaperCut installation directory. Example: bash check_cve_2026_81578.sh /home/papercut or bash check_cve_2026_81578.sh /opt/papercut. On Windows, adapt the file path checks or use the PowerShell equivalent.

#!/usr/bin/env bash
# check_cve_2026_81578.sh — CVE-2026-81578 PaperCut NG/MF Auth Bypass Check
# Usage: bash check_cve_2026_81578.sh <PAPERCUT_INSTALL_DIR>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

INSTALL_DIR="${1:-/opt/papercut}"
SERVER_DIR="$INSTALL_DIR/server"
VERSION_FILE="$SERVER_DIR/version.txt"
LIB_DIR="$SERVER_DIR/lib"
DATA_DIR="$SERVER_DIR/data/content"
LOG_FILE="$SERVER_DIR/logs/server.log"

echo "=== CVE-2026-81578 PaperCut NG/MF Vulnerability Check ==="
echo "Install dir: $INSTALL_DIR"
echo ""

# Check installation exists
if [ ! -d "$SERVER_DIR" ]; then
  echo "UNKNOWN — PaperCut server directory not found at $SERVER_DIR"
  exit 2
fi

# Read version
if [ -f "$VERSION_FILE" ]; then
  VERSION=$(head -1 "$VERSION_FILE" 2>/dev/null || echo "unknown")
  echo "Installed version: $VERSION"
else
  echo "WARNING: version.txt not found"
  VERSION="unknown"
fi

# Check for Emergency Patch Release 2 indicators
# Build numbers >= 76496 (NG) or 76497 (MF) for v25 indicate patched
BUILD=$(echo "$VERSION" | grep -oP '\d+$' 2>/dev/null || echo "0")
PATCHED=0

if [ "$BUILD" -ge 76496 ] 2>/dev/null; then
  echo "Build $BUILD is >= 76496 (Emergency Patch Release 2 threshold)"
  PATCHED=1
fi

# Check for IOCs
IOC_FOUND=0
echo ""
echo "--- IOC Checks ---"

# Check for suspicious .class files in lib
if [ -d "$LIB_DIR" ]; then
  SUSPECT_CLASSES=$(find "$LIB_DIR" -name '*.class' -newer "$LIB_DIR" -mtime -7 2>/dev/null | head -10)
  if [ -n "$SUSPECT_CLASSES" ]; then
    echo "WARNING: Suspicious .class files found in $LIB_DIR:"
    echo "$SUSPECT_CLASSES"
    IOC_FOUND=1
  else
    echo "OK: No suspicious .class files in $LIB_DIR"
  fi
fi

# Check for .cmd/.out files in data/content
if [ -d "$DATA_DIR" ]; then
  SUSPECT_CMD=$(find "$DATA_DIR" -name '*.cmd' -o -name '*.out' 2>/dev/null | head -10)
  if [ -n "$SUSPECT_CMD" ]; then
    echo "WARNING: Suspicious .cmd/.out files found in $DATA_DIR:"
    echo "$SUSPECT_CMD"
    IOC_FOUND=1
  else
    echo "OK: No suspicious .cmd/.out files in $DATA_DIR"
  fi
fi

# Check logs for exploitation signatures
if [ -f "$LOG_FILE" ]; then
  if grep -qiE 'jdbc:derby:memory:pwn|No suitable driver found for jdbc:no' "$LOG_FILE" 2>/dev/null; then
    echo "WARNING: Exploitation log signatures found in server.log"
    IOC_FOUND=1
  else
    echo "OK: No exploitation signatures in server.log"
  fi
  # Check if log was recently truncated (size 0 or very small but file is old)
  LOG_SIZE=$(stat -c%s "$LOG_FILE" 2>/dev/null || stat -f%z "$LOG_FILE" 2>/dev/null || echo "0")
  if [ "$LOG_SIZE" -lt 100 ] 2>/dev/null; then
    echo "WARNING: server.log is suspiciously small ($LOG_SIZE bytes) — may have been truncated"
    IOC_FOUND=1
  fi
else
  echo "WARNING: server.log not found — may have been deleted (IOC)"
  IOC_FOUND=1
fi

echo ""
echo "--- Verdict ---"
if [ "$IOC_FOUND" -eq 1 ]; then
  echo "ALERT: IOCs detected — this host may have been COMPROMISED. Investigate immediately."
fi

if [ "$PATCHED" -eq 1 ]; then
  echo "PATCHED — Emergency Patch Release 2 or later detected (build $BUILD)"
  exit 0
else
  echo "VULNERABLE — PaperCut version $VERSION is affected by CVE-2026-81578"
  echo "Apply Emergency Patch Release 2 and restrict network access to ports 9191/9192 immediately."
  exit 1
fi

Sources

1. PaperCut Urgent Security Advisory (Aug 27, 2026)
2. Huntress — PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
3. Rapid7 — PaperCut NG/MF Critical Zero-Day Exploited in the Wild
4. BleepingComputer — PaperCut Releases Second Emergency Patch
5. The Hacker News — Attackers Chain Two PaperCut Flaws
6. Help Net Security — PaperCut NG/MF Vulnerabilities Exploited
7. SC Media — PaperCut Emergency Patches
8. NHS England — PaperCut Critical Vulnerabilities Alert