On August 31, 2026, CISA added two PaperCut NG/MF vulnerabilities to its KEV catalog on the same day, with a note it rarely provides: each entry explicitly states the flaw can be chained with the other.
That detail is the subject of this article. Taken separately, both CVEs have prerequisites that make them manageable. Put end to end, they produce arbitrary code execution with no authentication at all.
Fixed versions: 24.1.9, 25.0.12 and 26.0.4.
The Two Links
| CVE | CVSS | Vector | What it grants |
|---|---|---|---|
| CVE-2026-81578 | 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Configuration changes without authentication |
| CVE-2026-82078 | 9.1 | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | Java code execution — but requires high privileges |
KEV added: 2026-08-31 for both. CISA deadline: 2026-09-14. NVD published: 2026-08-28.
Link 1 — CVE-2026-81578: bypassing access control
Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
The mechanism is a sequencing condition: the business action runs before access validation finishes. This isn't a missing check, it's a check that arrives too late — a pattern markedly harder to spot in code review than an absent if.
The result: an attacker with no account can change server configuration parameters.
Link 2 — CVE-2026-82078: turning configuration into code
The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
The database driver's class name is a configuration parameter, and the application instantiates it without checking it against an allowlist. Supplying an arbitrary class name present on the classpath means getting the server to run that constructor — that is, code.
Note the vector's PR:H: this flaw on its own requires administrator privileges. That is exactly what link 1 supplies.
The chain
CVE-2026-81578 → change configuration without authentication
↓
CVE-2026-82078 → the JDBC driver class name becomes an execution vector
↓
Java code running as the PaperCut server process
The full chain's score is neither 9.8 nor 9.1: it's unauthenticated RCE. That's why these two CVEs have to be treated as one subject, and why fixing only one of them is not enough.
Versions
| Product | Fixed version |
|---|---|
| PaperCut MF | 24.1.9, 25.0.12, 26.0.4 |
| PaperCut NG | 24.1.9, 25.0.12, 26.0.4 |
⚠️ These numbers are the version boundaries NVD publishes for each maintained branch. Confirm on the PaperCut portal which release applies to your branch before planning the update — the three numbers above aren't three alternatives, they're the fixes for three distinct branches.
Check your version:
Admin interface → About
Or server-side:
# Linux
cat /opt/papercut/server/version.txt 2>/dev/null || \
grep -i version /opt/papercut/server/logs/server.log | head -3
# Windows
Get-Content "C:\Program Files\PaperCut MF\server\version.txt"
Why PaperCut Is a Prime Target
PaperCut isn't software people talk about much, and that's precisely what makes it attractive to an attacker.
It's everywhere there are shared printers. Universities, schools, hospitals, local government, law firms, large enterprises: anywhere print accounting is needed for chargeback or cost control.
It's often exposed. The web interface lets users check their quota and release print jobs — so it's frequently reachable from the entire internal network, and sometimes from the internet to support printing while working remotely.
It's rarely patched quickly. It's a quiet piece of infrastructure, owned by the workplace-IT team rather than security, and taking it down visibly annoys everyone — which discourages out-of-window updates.
It has history. PaperCut has already been exploited at scale by ransomware crews. Operators know the product, know where it sits in a network, and have reusable tooling.
Its execution context is privileged. The PaperCut server is joined to the directory for user authentication, typically holds a service account with AD read rights, and talks to every printer on the network. It's an excellent pivot point.
Detection
Application logs
# Linux
tail -f /opt/papercut/server/logs/server.log
# Windows
Get-Content "C:\Program Files\PaperCut MF\server\logs\server.log" -Tail 100 -Wait
Signals to hunt:
- Configuration changes not tied to documented work — that's link 1's trace
- Any mention of a database driver or connection string change: that's link 2, and it's the most specific signal of this chain
- Java class loading errors, which can indicate failed attempts
- Administrative actions with no associated session
Configuration
Compare current configuration against a trusted earlier backup. The chain necessarily passes through a configuration change, so an unexplained divergence is a first-order indicator here — far more reliable than hunting for the exploitation request itself.
Options → Advanced → Config Editor
Pay particular attention to database-related keys.
Accounts and system
- Unknown PaperCut administrator accounts
- Anomalous child processes of the PaperCut server process — an RCE via class instantiation generally ends up launching something
- Outbound traffic initiated by the PaperCut server to anything other than its printers, directory and database
Mitigation
1. Update to the fixed release for your branch
That's the only complete fix. The CISA deadline was September 14; if it isn't done, it's the priority item.
2. Remove internet exposure — immediately
Link 1 is unauthenticated. As long as the admin interface is reachable from the internet, the chain is exploitable by anyone. If users print from outside, route that access through the VPN rather than publishing it directly.
3. Restrict access to the admin interface
PaperCut natively supports limiting administration to an address list:
Options → Advanced → Security → Allowed administration IP addresses
This applies with no service interruption and severs link 1 for any attacker outside the management network. Do it even after updating — it's a durable surface reduction that will hold for the next CVE too.
4. Reduce service account privileges
The PaperCut service account into Active Directory only needs read access to sync users. If it holds more, an RCE on the server becomes a directory compromise.
5. If you suspect a compromise
- Isolate the server from the network before investigating
- Compare configuration against an earlier backup, database parameters first
- Rotate credentials: AD service account, PaperCut database credentials, administrator passwords
- Audit the directory: if the service account was over-privileged, assume its reach may have been used
- On a server you believe executed attacker code, a reinstall followed by restoring audited configuration is safer than cleaning in place
Why Continuous Monitoring of Infrastructure Services Matters
Both CVEs in this article share a trait with most real compromises: they target software nobody considers sensitive. PaperCut appears in no risk analysis, shows up in no critical-application inventory, and its declared owner is usually the workplace-IT team. Yet it's authenticated against the directory, reachable from the whole network, and compromising it yields an ideal pivot.
With cveo.tech, inventory your infrastructure services — printing, backup, monitoring, asset management — alongside your application servers, and get automatic alerts whenever a critical CVE targets one of your exact versions.