# PaperCut Ships a Second Emergency Patch for an Actively Exploited Flaw

Page: https://hirantha.me/blog/papercut-ships-a-second-emergency-patch-for-an-actively-exploited-flaw
Published: 2026-09-01
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: papercut, vulnerability, remote code execution, patch management, cve-2026-82078

> PaperCut rushed out a second emergency patch after researchers broke its first fix for a bug already under attack.

Print management software maker PaperCut needed two tries in one day to close a hole that attackers were already walking through. The company's first emergency patch, released on August 28, was bypassed by security researchers within hours, forcing a second release before most administrators had even finished applying the first one.

## A two-step path to full server control

The trouble comes from two flaws that work as a pair. The first, tracked as CVE-2026-81578 (Common Vulnerabilities and Exposures) and rated 8.8 out of 10 on the CVSS (Common Vulnerability Scoring System), is an access control weakness in the web management interface built into PaperCut NG and PaperCut MF. It lets an unauthenticated remote request reach administrative functions before the server has finished checking whether that request is allowed.

The second, CVE-2026-82078, rated 9.4, sits in the product's database utilities. PaperCut loads database driver classes by name without checking them against an approved list. An attacker who can alter configuration parameters can use that gap to run arbitrary Java bytecode inside the application server process.

Neither flaw is catastrophic by itself. Chained together, they give a remote attacker with no credentials a path to full code execution on any internet-facing PaperCut server, which is precisely the kind of software many organizations install in exactly that spot to let printers report status and let users release print jobs from a browser.

## Attackers moved before defenders did

Security firm Huntress says it first observed exploitation attempts on August 26, two days before PaperCut had even published an advisory. The company issued a security bulletin on August 27, followed a day later by its first emergency patch for PaperCut NG and MF versions 24 through 26.

That patch did not hold. Researchers at watchTowr reproduced the full attack chain and found multiple ways around the fix on the same day it shipped, along with an additional authentication bypass PaperCut had not accounted for. PaperCut responded with a second emergency release, adding hardening and, this time, extending a backport down to version 24.

Huntress says it observed the exploit used against at least two of its own customers. The activity looked like reconnaissance rather than a full break-in: attackers ran basic system discovery commands and, in one case, the entire intrusion lasted under two minutes. Huntress reported no secondary malware, no follow-on command-and-control traffic, and no sign of an attacker settling in for the long term. That pattern is typical of access brokers, who compromise a server just far enough to confirm it is valuable, then sell the foothold to someone else who does the actual damage. It does not mean the threat is minor; it means the follow-up attack, if there is one, may not have happened yet.

## Who is exposed and what to do

The affected versions are PaperCut NG and PaperCut MF 24, 25, and 26, across Windows, Linux, and macOS. Anyone still running version 23 or earlier does not get a backported fix and needs to upgrade to a supported version outright.

For everyone else, the fix is Emergency Patch Release 2, not the first patch from August 28. Administrators who installed only the initial release are still exposed to the bypass watchTowr found and should update again immediately.

Beyond patching, PaperCut servers should not be reachable from the open internet if it can be avoided at all; the access control flaw only matters to an attacker who can reach the management interface in the first place. Administrators should also check application logs for unexpected process launches or unfamiliar `.class` files, the artifact Huntress used to spot the intrusions it found.

## What this means for you

If your organization runs PaperCut NG or MF as an internet-facing service, patching once was not enough this week. Confirm you are on Emergency Patch Release 2 specifically, not just "a patch from this week," and treat any PaperCut server that has been reachable from outside your network since August 26 as a server worth checking for signs of the reconnaissance Huntress described, even after you patch.

## Questions

**What versions of PaperCut are affected?**
PaperCut NG and PaperCut MF versions 24, 25, and 26 on Windows, Linux, and macOS. Version 23 and earlier do not get a backported fix and need a full upgrade.

**Is the first PaperCut patch from August 28 enough?**
No. Researchers at watchTowr bypassed that first patch within hours, so administrators need Emergency Patch Release 2, PaperCut's second fix issued the same day.

**Has this vulnerability actually been exploited?**
Yes. Huntress observed exploitation starting August 26 and confirmed the full attack chain against at least two of its customers, though the activity seen so far looks like reconnaissance rather than a complete breach.

**What should administrators do right now?**
Apply Emergency Patch Release 2, remove PaperCut's management interface from public internet access if possible, and check logs for unexpected processes or unfamiliar .class files.

## Sources

- [PaperCut releases second emergency patch for exploited flaws](https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/), BleepingComputer
- [More Details Emerge on Exploited PaperCut Vulnerabilities](https://www.securityweek.com/more-details-emerge-on-exploited-papercut-vulnerabilities/), SecurityWeek
- [PaperCut Issues Second Emergency Patch As Researchers Break Fix For Exploited Zero-Days](https://thecyberexpress.com/papercut-issues-second-emergency-patch/), The Cyber Express