Two PaperCut flaws chain into unauthenticated code execution, and the patch has bypasses

Attackers are chaining two PaperCut NG and MF flaws affecting versions 24, 25, and 26. CVE-2026-81578 (CVSS 8.8) is an access control failure that lets an unauthenticated request trigger administrative backend actions before access validation completes. CVE-2026-82078 (CVSS 9.4) is unsafe dynamic class loading in the database connection utilities. Per watchTowr, the bypass gets you in, editing a configuration file gets you code execution. Exploitation was observed from August 27, 2026, with attackers dropping Java class files that ran Base64-encoded reconnaissance such as whoami & ver & tasklist. PaperCut shipped emergency patches with extra hardening, but bypasses affecting fully patched builds have since been found.

Why it matters

PaperCut has been here before: CVE-2023-27350 and CVE-2023-27351 were the same shape, an authentication bypass in the management interface, and both ended up in ransomware chains. The lesson repeats because the exposure repeats. Print management servers sit deep inside networks, run with high privilege, hold directory service credentials for user lookup, and get published to the internet for remote printing without anyone treating them as an identity system. They are. With patch bypasses circulating, patching alone is not a resolution: pull the management interface off the public internet, restrict web access to trusted ranges or put it behind a VPN, hunt logs for Database error looking up cardID: VALUES CAST, and rotate the directory credentials the server holds.

Source: The Hacker News