Overview
Two vulnerabilities affecting PaperCut NG/MF print management software were disclosed and actively exploited in August 2026. When chained, they allow an unauthenticated attacker to achieve remote code execution.
CVE-2026-81578 (CVSS 8.8) is an authentication bypass via Apache Tapestry "complex direct" requests. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class loading vulnerability in database connection utilities.
Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog.
Affected Component
PaperCut NG and PaperCut MF versions before 24.1.10.
Research Context
This research tool was built to support authorized security assessment of PaperCut NG/MF installations. It provides non-destructive vulnerability detection and optional assessment capabilities for organizations that need to validate their exposure to these CVEs.
Technical Summary
CVE-2026-81578 allows an attacker to bypass authentication on the PaperCut web administration interface due to inadequate access controls during the execution of certain administrative functions.
CVE-2026-82078 stems from unsafe dynamic class loading in PaperCut's database connection utilities. When an external lookup is performed, the configured connection URL is used to load classes without proper validation, enabling code execution. This vulnerability requires the authentication bypass to be exploitable in practice.
The assessment tool performs indicator-based detection and reports confidence scores capped at 85% to avoid over-claiming exploitability.
Testing Environment
Testing was conducted in a local lab environment reproducing the PaperCut setup. The tool includes an educational local lab for understanding the vulnerability concepts in a controlled setting.
Impact
Chained exploitation allows unauthenticated remote code execution, leading to full compromise of PaperCut servers. PaperCut is widely deployed in enterprise print management environments.
Disclosure
These vulnerabilities were disclosed by PaperCut and external security researchers. The assessment tool is intended for authorized security testing only. The tool does not claim to prove exploitability on live systems unless explicit authorization is provided.
Timeline
-
August 27, 2026
PaperCut releases urgent security advisory and fixes for both vulnerabilities in version 24.1.10.
-
August–September 2026
Active exploitation observed. CISA adds both CVEs to the Known Exploited Vulnerabilities catalog.
-
August 29, 2026
Research assessment tool published on GitHub.
References
- GitHub Repository — PaperCut-CVE-2026-81578-82078
- PaperCut Security Bulletin — August 27, 2026
- Rapid7 — PaperCut NG/MF Critical Zero-Day Exploited in the Wild
- SonicWall — PaperCut NG/MF Unauthenticated RCE Chain