PaperCut’s First Emergency Patch Was Not the Finish Line. Attackers Chained Two Flaws to Reach Code Execution.
PaperCut’s first emergency patch was not the finish line. The company has released Emergency Patch Release 2 after researchers found additional bypasses and hardening gaps. The incident is now tied to two vulnerabilities that attackers can chain from an unauthenticated web request to arbitrary Java code execution.
PaperCut says active exploitation has affected confirmed customers. Huntress independently reproduced the complete pre-authentication code-execution chain and observed exploitation in two customer environments. The attacks performed rapid system reconnaissance, delivered Java class files and attempted to remove logs after execution.
Emergency Patch Release 2 is now available for PaperCut NG and PaperCut MF versions 24, 25 and 26 on Windows, Linux and macOS. PaperCut recommends that every customer install Release 2 even if the original emergency patch is already present. Customers running version 23 or earlier should upgrade to the latest supported version.
Update, 30 August: PaperCut now recommends a rebuild after suspected compromise
PaperCut expanded its incident guidance on 30 August with new indicators and a much stronger recovery position. If compromise is suspected, the vendor now recommends securing current backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before the first suspicious behaviour. An in-place patch is not presented as sufficient incident recovery.
The updated indicators include five-character random file names written as <install>\server\lib\<name>.class, <install>\server\data\content\<name>.cmd and <install>\server\data\content\<name>.out. PaperCut also documented DB URL: jdbc:no:x DB Driver: <5-char random name> and related Derby strings in server.log. The company warns that attackers may clean up these files, so their absence does not rule out compromise.
Observed post-exploitation activity now includes pc-app.exe spawning cmd.exe, running whoami & ver, enumerating processes, domain controllers and logged-on users, and then downloading SimpleHelp and AnyDesk. Defenders should check for an unexpected Windows service named Remote Access Service running SimpleService.exe from C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\, as well as unapproved AnyDesk installations.
PaperCut is still working toward an official release. The current Release 2 packages remain emergency patches. Customers using SQL Server for external Card or ID lookups with the legacy SourceForge jTDS driver are advised to move to the latest supported Microsoft SQL JDBC driver. Site Servers and secondary or print servers must also be updated to a patched version.
Update, 31 August: CISA puts both PaperCut flaws on the KEV list
CISA added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalogue on 31 August. The catalogue feed was released at 14:55 UTC, or 16:55 Europe/Madrid. US federal civilian agencies have until 14 September 2026 to complete the required action.
The KEV entry removes any remaining ambiguity about operational priority. CISA requires organisations to apply the vendor’s mitigations, follow Binding Operational Directive 26-04 guidance for edge devices, and satisfy the agency’s forensic triage requirements for internet-facing systems. PaperCut’s own guidance remains stronger than a simple patch instruction: where compromise is suspected, preserve evidence, wipe and rebuild the Application Server, then restore from a clean backup that predates the suspicious activity.
The two catalogue entries are separate because each vulnerability crosses a different boundary. CVE-2026-81578 bypasses authentication and permits configuration changes. CVE-2026-82078 turns control of that configuration into arbitrary Java code execution. In the observed chain, the first flaw supplies the prerequisite for the second.
What changed after the first emergency patch
The original bulletin confirmed exploitation but did not name the vulnerable components or assign CVE identifiers. The updated disclosure now identifies an authentication bypass and an unsafe dynamic class-loading flaw. Used together, they allow an unauthenticated attacker to change trusted configuration and execute code inside the PaperCut Application Server process.
| Vulnerability | Impact and prerequisites | Fix and exploit status |
|---|---|---|
| CVE-2026-81578 Authentication bypass CVSS 8.8 | Specially crafted unauthenticated requests can cause administrative backend actions to run before access validation completes. This allows a remote attacker to modify certain system configurations. | Mitigated in Emergency Patch Release 2. PaperCut confirms active exploitation of the vulnerability chain. Huntress reproduced the bypass as part of a complete proof of concept. |
| CVE-2026-82078 Unsafe dynamic class loading CVSS 9.4 | PaperCut’s database utilities instantiate driver classes from configurable names without restricting them to an allowlist. An attacker able to change those settings can execute arbitrary Java bytecode already reachable through the application classpath. | Mitigated in Emergency Patch Release 2. The high-privilege configuration prerequisite can be supplied by the authentication bypass, producing unauthenticated code execution. |
Huntress has a working proof of concept for the complete chain but has not published exploit code. Its researchers demonstrated a remote request causing charmap.exe to run as SYSTEM under pc-app.exe on a stock PaperCut NG installation.
PaperCut says Release 2 includes additional hardening developed with Huntress and watchTowr. Independent reporting says watchTowr found multiple ways to bypass the first patch and another authentication-bypass path. That materially changes the remediation message: installing the initial emergency package is no longer sufficient.
What attackers did after reaching the server
Huntress observed two exploitation incidents. Activity in one environment on 26 August lasted less than two minutes. Base64-encoded commands decoded to whoami & ver, identifying the account and Windows version. A second incident on 27 August added tasklist to enumerate running processes.
The attackers also delivered an operating-system-independent Java class file. Huntress recovered Udydn.class and another copy named Moo97.class from a PaperCut installation. The code could run commands on Windows or Linux, collect a directory listing and write the results to Udydn.out.
The payload then deleted its output, PaperCut’s server.log and the Derby database log. That behaviour makes evidence preservation important. A restart, hurried cleanup or in-place upgrade can remove context needed to determine what happened before the patch.
Huntress’s reproduced chain used an attacker-controlled SMB2 share to deliver the Derby archive. Where business requirements allow, defenders should restrict or closely monitor outbound SMB from the PaperCut server.
Release 2 coverage and component guidance
| Environment | Required action |
|---|---|
| PaperCut NG or MF version 24, 25 or 26 | Install the matching Emergency Patch Release 2 package for Windows, Linux or macOS. Replace the first emergency patch if it was already installed. |
| PaperCut NG or MF version 23 or earlier | Upgrade to the latest supported version. PaperCut has not provided Release 2 packages for these older branches. |
| Site Servers and secondary or print servers | Update these components to a patched version as well as the primary Application Server. |
| Print Deploy and Mobility Print | PaperCut says these components are not affected and do not require this emergency update. |
| External database used for Card or ID number lookups | Add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server. Release 2 disables this rarely used feature by default. |
The vendor still instructs administrators to restrict internet-facing Application Server interfaces to trusted IP addresses. Patching removes the reported vulnerable conditions. It does not prove that a previously exposed server was never compromised.
Indicators and evidence to preserve
- Child processes, command execution or unusual network connections originating from
pc-app.exe. - Missing, unexpectedly truncated or deleted
server.logor Derby log files. - Files named
Udydn.class,Moo97.class,Udydn.outorUdydn.cmdunder the PaperCut server directory. - The encoded command strings associated with
whoami & verorwhoami & ver & tasklist. DB URL: jdbc:derby:memory:pwnnear a large encoded data blob.ERROR No suitable driver found for jdbc:no:x.ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST.- Unexpected outbound SMB connections from the PaperCut server.
PaperCut warns that the absence of its published indicators does not prove a system is unaffected. Preserve the full PaperCut logs directory and file metadata, current and non-default configuration, endpoint process trees, reverse-proxy records, firewall and DNS telemetry, recent services, scheduled tasks, autoruns and file creation events.
What defenders should do now
- Remove public exposure. Restrict PaperCut’s web interfaces to trusted addresses or place administrative access behind a controlled path such as a VPN.
- Preserve evidence before changing the host. Collect logs, file metadata and endpoint telemetry before a restart or upgrade where incident-response requirements permit.
- Install Release 2 everywhere it applies. Patch versions 24 through 26 and include Site Servers and secondary or print servers.
- Upgrade older branches. Version 23 and earlier do not have Release 2 packages.
- Hunt for execution and cleanup. Review activity under
pc-app.exe, the named Java files, log deletion and outbound SMB. - Rotate exposed secrets after scoping the incident. Include service accounts, database credentials and other secrets accessible from the PaperCut host.
The BlackTree view
The operational lesson is not simply that PaperCut had two vulnerabilities. It is that the first emergency patch arrived while exploitation was already happening, and researchers then found ways around it.
Emergency updates compress testing time, but they do not lower the standard for verification. Administrators need to confirm the exact release installed on every server component, preserve evidence from the exposure window and keep network containment in place until the investigation is complete.
Sources
- PaperCut urgent security bulletin. Initially published 27 August 2026 with no time provided. Release 2 was published 28 August at 20:42 AEST, or 12:42 Europe/Madrid. Version 24 packages followed at 22:08 AEST, or 14:08 Europe/Madrid.
- Huntress investigation and proof-of-concept analysis, published 27 August 2026.
- BleepingComputer report on Release 2 and patch bypasses, published 28 August 2026 at 15:08. The page does not identify a timezone.
- NHS England Digital cyber alert CC-4838, published 28 August 2026 at 15:05.
- CISA Known Exploited Vulnerabilities catalogue, feed release 31 August 2026 at 14:55 UTC, or 16:55 Europe/Madrid. Both PaperCut vulnerabilities have a federal remediation deadline of 14 September 2026.
