PaperCut has confirmed active, in-the-wild exploitation of two chained vulnerabilities in PaperCut NG and PaperCut MF, and it shipped emergency, out-of-cycle patches less than a day after publishing the advisory. If you run an internet-accessible PaperCut Application Server, the company wants it locked down now, not at your next scheduled patch window.

  • PaperCut published an URGENT security advisory on August 27, 2026 confirming active exploitation of PaperCut NG and MF, and it now considers all versions potentially impacted.
  • Two CVEs are involved: CVE-2026-82078 (CVSS 9.4), an unsafe dynamic class loading flaw in the database connection utilities, and CVE-2026-81578 (CVSS 8.8), an access control bypass in the web management interface.
  • Emergency patches shipped August 28, 2026 at 02:10 AEST for versions 25 and 26, with a version 24 patch following later the same day, across Windows, Linux, and macOS installers.
  • Huntress has documented exploitation on at least two customer environments, and PaperCut is telling every admin with an internet-facing Application Server to restrict access immediately, even without any signs of compromise yet.

What actually happened

PaperCut's own knowledge base article is titled, plainly, an "URGENT Security Advisory," which is about as blunt as vendor bulletins get. The company says it is aware of confirmed customer incidents involving PaperCut NG and MF and is treating the matter with the highest priority. According to Rapid7's writeup, the case that got this started came from a university customer, whose security team handed PaperCut the forensic evidence needed to reproduce the flaw. From there PaperCut moved fast: the advisory went public on August 27, and the first emergency patches followed inside a day.

RelatedOracle WebLogic's CVE-2026-21962: The 3-Day Deadline Is Today

How CVE-2026-81578 and CVE-2026-82078 chain into code execution An unauthenticated attacker exploits CVE-2026-81578, an access control bypass in PaperCut's web management interface, to reach CVE-2026-82078, an unsafe dynamic class loading flaw in the database connection utilities, resulting in arbitrary code execution on the PaperCut Application Server. ATTACK CHAIN Attacker no credentials Web management interface CVE-2026-81578 CVSS 8.8 · access control bypass Database connection utilities CVE-2026-82078 CVSS 9.4 · unsafe class loading Arbitrary code execution on the Application Server Both flaws sit in the PaperCut Application Server, reachable through its web console. Huntress has observed both steps chained together in live customer environments. genztech.blog
Fig 1 The two CVEs form a single kill chain: CVE-2026-81578 skips authentication in the web console, then CVE-2026-82078 turns that access into arbitrary code execution through the database connection utilities. Huntress has already observed both steps used together against live customers.

What are the two vulnerabilities?

There are two CVEs, and the concerning part is how well they fit together. CVE-2026-81578, rated 8.8, is an improper access control flaw in PaperCut's web management interface: certain administrative requests trigger backend actions before the server finishes checking whether the requester is actually allowed to make them. CVE-2026-82078, rated 9.4 and the more severe of the pair, is an unsafe dynamic class loading bug in the database connection utilities, the kind of flaw that lets an attacker point the server at arbitrary Java classes and get code execution out of it. Chain the two together and an unauthenticated request can walk through the access control gap and land on a code execution primitive, which is about the worst outcome a print management server can have.

Huntress, the managed security firm, has already documented limited exploitation on two customer environments, where attackers ran base64-encoded commands invoking whoami and ver, the kind of quiet reconnaissance someone runs to confirm a working foothold before doing anything louder. That is early-stage access rather than a full breach in the cases published so far, but it confirms the chain works outside a lab.

Why does this matter for schools and enterprises?

PaperCut is print management software, which sounds unglamorous until you remember what makes it attractive to an attacker: it typically runs with elevated privileges, sits deep inside a network to talk to every printer on a floor, and is disproportionately common at universities, school districts, and large enterprises that install it once and rarely touch it again. That profile is exactly why PaperCut had its worst year in 2023, when CVE-2023-27350, an authentication bypass in the same product line, was picked up by ransomware affiliates tied to Bl00dy and LockBit and used to hit schools and universities across multiple countries.

Nothing published so far ties this new pair of CVEs to a specific ransomware group, and PaperCut's own language describes confirmed customer incidents rather than a mass campaign. But the 2023 playbook is exactly why security teams aren't waiting to find out. A vulnerability this severe, in software this widely deployed at organizations that are historically slow to patch, is the setup for a repeat, whether or not that repeat actually happens this time.

The patch timeline

PaperCut moved unusually fast once it had a reproducible exploit in hand, though the picture is still developing.

RelatedSonicWall VPN Zero-Days Rooted Appliances for Weeks

  1. Aug 27, 2026Urgent security advisory published. PaperCut confirms active exploitation and customer incidents, and says all versions are potentially impacted.
  2. Aug 28, 2026 · 02:10 AESTEmergency patch for v25 and v26. Windows, Linux, and macOS installers released for the two most current branches.
  3. Aug 28, 2026Patch for v24 follows. Released later the same day, extending coverage to the older supported branch.
  4. OngoingInvestigation and hardening continue. PaperCut says it expects to issue further guidance as its investigation develops.

What should PaperCut admins do right now?

Patch first, then lock down. PaperCut's own guidance is to apply the emergency release for your branch immediately, and if your Application Server is reachable from the public internet, restrict access to trusted IP addresses with a firewall rule or equivalent network control before doing anything else, even if you haven't seen anything suspicious yet. That last part matters: PaperCut is explicit that no visible compromise is not the same thing as no risk. Security teams should also check their logs for the indicators researchers have already published, unusual activity around pc-app.exe, missing or truncated server.log entries, and error lines referencing an unexpected JDBC driver, since those are the fingerprints of the exploitation Huntress and others have observed.

What to watch
  • A public proof of concept. Exploitation so far looks targeted and researcher-documented. A public PoC would open the door to mass scanning within days.
  • Ransomware pickup. CVE-2023-27350 went from patch to ransomware campaign in weeks. Whether an extortion crew adopts this pair the same way is the single biggest risk factor here.
  • A CISA KEV listing. Given confirmed active exploitation, addition to CISA's Known Exploited Vulnerabilities catalog looks likely, which would force a hard deadline on US federal agencies.
  • Whether these patches hold. Emergency, out-of-cycle fixes sometimes need a follow-up release once broader testing surfaces edge cases.

Our take

The most striking thing about this advisory isn't the CVSS scores, it's how familiar the shape of the story already is. Print management software keeps turning out to be exactly the kind of infrastructure that gets ignored until it's the reason a network is compromised, and PaperCut is now the vendor with two incidents like this on its record in three years. That's not entirely PaperCut's fault. It's what happens when a product category is boring enough that nobody prioritizes patching it, privileged enough that compromising it is worth an attacker's time, and common enough at schools and universities that a single flaw reaches thousands of under-resourced IT departments at once. PaperCut deserves some credit for the response: a same-day emergency patch across three branches and three operating systems is fast by any vendor's standard, and it published the advisory before waiting for a fully wrapped-up investigation. Whether that speed is enough depends entirely on how quickly admins act on it, and if 2023 is any guide, a meaningful number won't move until there's a headline about a specific school district or hospital getting hit. The fix already exists. The gap that matters now is the one between shipping a patch and organizations actually applying it.

Primary sources

Original analysis by GenZTech, based on PaperCut's official security bulletin and independent security research.