On August 27, 2026, PaperCut Software published an urgent security bulletin confirming what every organization with internet-facing print infrastructure feared: attackers were actively exploiting a previously unknown vulnerability chain in PaperCut NG and PaperCut MF. Within 48 hours, the vendor had assigned two CVEs, shipped an emergency patch, discovered that patch was bypassed, and shipped a second emergency fix built with input from Huntress and watchTowr researchers.
This is one of the fastest public patch-bypass-repatch cycles in recent memory. And it exposes a uncomfortable truth: the software your office relies on every day might be the weakest link in your security posture.
The Two Flaws That Changed Everything
The attack chain combines two vulnerabilities that are devastating on their own but catastrophic together.
CVE-2026-81578 (CVSS 8.8) is an authentication bypass in PaperCut's web management interface. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete. In plain terms: an attacker can reach admin-level functions without ever providing a password.
CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading flaw in the database connection utilities. The application loads database driver classes based on configurable driver names without validating them against an approved allowlist. If an attacker can manipulate system configuration parameters, they can execute arbitrary Java bytecode under the security context of the PaperCut server process.
Together, these flaws create a clean pre-authentication remote code execution chain. As watchTowr's Jake Knott explained: "CVE-2026-81578 allows you to bypass authentication, and from there you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution."
Active Exploitation in the Wild
This was not a theoretical exercise. Huntress observed exploitation in two customer environments on August 26-27, with attacker activity focused on system discovery commands like whoami, ver, and tasklist, along with heavy anti-forensics activity.
The attackers were methodical. They gained access through the authentication bypass, modified system configuration to load a malicious Java class, and then ran reconnaissance commands to understand the compromised environment before covering their tracks.
What makes this particularly dangerous is that PaperCut servers are often internet-facing by design. Organizations deploy them to allow employees to print from anywhere. That convenience just became an open door.
The Patch That Wasn't Enough
Here is where the story gets alarming. PaperCut shipped an initial emergency patch on August 27. Within hours, watchTowr researchers fully reproduced the vulnerabilities, discovered multiple bypasses for the first patch, and identified an additional authentication bypass vulnerability.
This forced PaperCut to release Emergency Patch Release 2 on August 28, incorporating additional hardening developed in collaboration with Huntress and watchTowr.
"If you applied only the first patch, you are not protected," PaperCut warned. This is a critical distinction for IT teams who may have patched on Wednesday and assumed they were safe by Thursday.
The Unpatchable Majority
Perhaps the most sobering statistic comes from Huntress: roughly 47% of the approximately 2,500 PaperCut installations they track run version 23 or older. For these systems, no emergency patch exists. The only path forward is a full upgrade.
That means nearly half of all known PaperCut installations cannot be patched against this vulnerability chain without a major version upgrade — a process that typically requires planning, testing, and downtime that many organizations cannot arrange on short notice.
Detection and Response
The good news is that detection is feasible right now. Vendor-confirmed log signatures include:
ERROR DatabaseUtils - Database error looking up cardID: VALUES CASTERROR No suitable driver found for jdbc:no:x- The
jdbc:derby:memory:pwnbreadcrumb in server logs
Security teams should immediately:
- Check your version. If you run PaperCut NG or MF, confirm whether you are on v24 or later. If you are on v23 or older, plan an emergency upgrade.
- Apply Emergency Patch Release 2. Even if you already installed the first patch, Release 2 is mandatory. The first patch was bypassed.
- Audit your logs. Search for the indicator strings above. If you find them, assume compromise and begin incident response.
- Restrict access. If you cannot patch immediately, take the web management interface off the public internet. VPN-only access is a viable stopgap.
- Monitor for follow-on activity. Attackers who gained access may have established persistence. Check for new user accounts, scheduled tasks, and unusual network connections.
What This Means for Your Business
The PaperCut incident is a wake-up call about supply chain risk in everyday infrastructure. Print management software is not glamorous. It does not get the same security scrutiny as your identity provider or your cloud platform. But it sits on your network, runs with elevated privileges, and often faces the internet.
This pattern — attackers targeting overlooked infrastructure software — is accelerating. From PaperCut to MOVEit to Barracuda, the lesson is consistent: if it is connected, it is a target.
For organizations in the Middle East and beyond, this is the time to audit your internet-facing assets. Not just the obvious ones. The print server, the backup console, the management interface that "nobody uses" — those are exactly the doors attackers are walking through.
The bottom line: Patch PaperCut to Release 2 today. If you cannot patch, isolate. And while you are at it, ask yourself what other "set and forget" infrastructure is sitting on your network, waiting to be discovered.