Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Huntress

  • PaperCut’s zero-day is now two chained CVEs, and the first emergency patch does not stop the chain

    PaperCut’s zero-day is now two chained CVEs, and the first emergency patch does not stop the chain

    PaperCut’s unnamed zero-day now has two CVE numbers, a confirmed chain, and a second emergency patch — because researchers bypassed the first one. Anyone who patched on 27 August is not protected.

    What happened

    On 27 August 2026, PaperCut published an urgent security bulletin saying customers were being attacked through a flaw in its NG and MF print management servers. There was no CVE identifier, no description of the vulnerability, and no entry in CISA’s Known Exploited Vulnerabilities catalog. We covered that bulletin, and the out-of-band builds that shipped alongside it, here.

    Two things changed on 28 August.

    First, the flaw got numbers. NVD published CVE-2026-82078 at 16:18 UTC on 28 August and CVE-2026-81578 the same day. Both records are still in Received status and were last modified on 29 August.

    CVE-2026-82078 carries a CVSS v4.0 base score of 9.4, Critical, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, and is classed CWE-470. The NVD description reads, verbatim: “An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.”

    CVE-2026-81578 carries a CVSS v4.0 base score of 8.8, High, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. It is an improper access control flaw in the web management interface: unauthenticated remote requests aimed at administrative functions can trigger backend actions before access validation finishes, which is enough to modify configuration.

    Second, the patch changed. PaperCut shipped Emergency Patch Release 2 on 28 August at approximately 2:45 p.m. Eastern, covering versions 24, 25 and 26 on Windows, Linux and macOS. The NVD records place the fix boundaries at 24.1.10, 25.0.13 and 26.0.5, which supersedes the 26.0.4 and 25.0.12 builds that went out on 27 August. Version 24, which had no fix at all when the bulletin first appeared, now has one.

    The reason for the second patch is the part worth reading twice. According to reporting that both Rapid7 and BleepingComputer carry, watchTowr reproduced the vulnerabilities in full, found multiple bypasses of the first emergency patch, and identified a further authentication bypass. Help Net Security reports PaperCut’s guidance as: install Release 2 even if you have already applied the original emergency patch. Rapid7 puts it more bluntly — an organization running the first patch is not protected.

    Huntress, which observed the attacks, states the relationship between the two flaws directly: “Chained together these flaws enable pre-authentication remote code execution in the PaperCut Application Server.” Its telemetry still describes two customer environments, the first on 26 August lasting under two minutes, the second on 27 August on a server running 24.1.5.71847. PaperCut told reporters the attacks “appear limited and targeted” and that it is withholding post-exploitation detail while it investigates.

    Why it matters

    Look at what the two vectors say on their own, because this is where score-driven triage fails.

    CVE-2026-82078 is the 9.4, and it requires high privileges: PR:H. Read alone, it is an administrator-only bug — serious, but not the thing you drop a Friday for. CVE-2026-81578 needs no privileges at all, but its confidentiality impact is low and its scope is unchanged; read alone, it is a configuration-tampering flaw. Neither record, on its own terms, describes an unauthenticated attacker getting code execution on a print server.

    Together they do, and the mechanism is visible in the two records without anyone having to explain it. The 8.8 lets an unauthenticated request reach an administrative function and change configuration. The 9.4 is a class loader that instantiates “database driver classes based on configurable driver names” with no allowlist. Change the configurable name, and the thing that needed admin rights is handed to you by the thing that did not.

    That reading also lines up with an indicator PaperCut published on 27 August, before either CVE existed: ERROR No suitable driver found for jdbc:no:x. A JDBC driver string that resolves to nothing is exactly the residue of an attempt to make the application load a class by name. PaperCut has not said the two are connected and we are not reporting that it has — but the vendor was publishing the fingerprint of the class-loading path a full day before the class-loading CVE was assigned.

    CVSS has no way to express any of this. There is no chain field. Both scores are correct for what they measure and both understate the situation, and an organization sorting a patch queue by base score would put a PR:H 9.4 behind any number of unauthenticated 9.8s. This is a recurring problem and it is worth naming: the chain, not the component, is the unit of risk, and the record is organized around components.

    The second point is about the federal record, and it is a live discrepancy rather than a theory. Both NVD entries carry CISA’s SSVC decision points. On CVE-2026-82078 they read Exploitation: none, Automatable: no, Technical Impact: total. On CVE-2026-81578 they read Exploitation: none, Automatable: yes, Technical Impact: partial.

    “Exploitation: none” is on both, on 29 August, on a vulnerability the vendor has confirmed is being used against its customers and for which it has now shipped two emergency patches in two days. Neither record carries a cisaExploitAdd date, so there is no KEV entry and no federal remediation deadline attached to any of this.

    We do not read that as CISA getting it wrong. These records went up hours after assignment and are still in Received status; SSVC values on a fresh record are an initial assessment, and they get revised. The point is operational: right now, anyone pulling PaperCut’s risk posture from the machine-readable record gets “not exploited,” while the vendor bulletin says the opposite. If your prioritization is automated off NVD, this is the case where it is wrong in the direction that costs you.

    It is also worth noting which words those decision points use. Exploit automation and total-versus-partial technical impact are two of the four variables BOD 26-04 uses to derive federal remediation deadlines. We are not asserting a mapping — CISA publishes the authoritative schedule only as images, and public transcriptions of it disagree with one another. But the inputs to that schedule are, for this vulnerability, currently recorded as “not exploited.”

    Third: watchTowr’s further authentication bypass is, as reported, an additional flaw rather than one of the two numbered here, and we found no CVE for it and no PaperCut statement naming it. Release 2 is described as fixing it. That leaves an unnumbered vulnerability inside a shipped patch — a thing to watch, not a thing to act on.

    What to do

    • Apply Emergency Patch Release 2. Target 24.1.10, 25.0.13 or 26.0.5 or later, per the fix boundaries in the NVD records. If you patched on 27 August to 26.0.4 or 25.0.12, you are on the bypassed build.
    • Version 24 now has a fix where it did not before. If you deferred because nothing was available, re-check.
    • Keep the network restriction in place regardless. PaperCut’s original mitigation stands: if the Application Server is reachable from the public internet, restrict web access to trusted IP addresses. Given a patch that has already been bypassed once, treat exposure reduction as the control and the patch as the backup.
    • Hunt for the pre-patch window. The original indicators still apply, and they matter more now that we know the mechanism: ERROR No suitable driver found for jdbc:no:x in server.log, base64 strings in server.log, missing or truncated logs, and stray .class files. Huntress recovered Udydn.class and Moo97.class, which self-delete. Absence of indicators is not evidence of cleanliness — the vendor said so itself.
    • If you run v23 or older, you have no patch. Huntress reports 47 percent of the roughly 2,500 PaperCut installations it tracks are on v23 or earlier. That is one vendor’s visibility, not a global census, but for those servers network isolation is the entire answer.
    • Do not wait for a KEV entry. There is none, and if your process keys on federal deadlines this will not trip it.

    Sourcing note

    Checked: NVD’s API records for CVE-2026-82078 and CVE-2026-81578, which supplied the descriptions, CVSS v4.0 vectors, CWE, affected-version boundaries and CISA SSVC decision points quoted above, and which confirm no cisaExploitAdd or cisaActionDue on either; Huntress’s own writeup for the exploitation observations, the chaining statement and the installed-base figure.

    Could not reach: PaperCut’s security bulletin at papercut.com renders its body through client-side script and returned only navigation to us on repeated attempts, so every quotation attributed to PaperCut here is taken from outlets that read the bulletin — Rapid7, BleepingComputer and Help Net Security — and is labeled as such rather than quoted as primary. watchTowr’s findings were published to LinkedIn, which we could not fetch; they are reported here as secondary, via Rapid7 and BleepingComputer, which agree on the substance.

    One record oddity: at approximately 11:50 UTC on 29 August, a direct NVD lookup by cveId=CVE-2026-81578 returned zero results while a keyword query returned the full record. That is an indexing lag, not a retraction.

    Unresolved: exact build numbers for Emergency Patch Release 2, which we could not confirm from a primary source — use the version boundaries instead. Whether watchTowr’s additional authentication bypass will receive its own CVE. Whether CISA will add either CVE to the KEV catalog, and whether the SSVC decision points on these records will be revised from “Exploitation: none.” We will follow the KEV catalog and update if that changes.

  • PaperCut is under active attack with no CVE, and the emergency patch skipped its own release process

    PaperCut is under active attack with no CVE, and the emergency patch skipped its own release process

    Update, 29 August 2026. Both flaws now have CVE identifiers — CVE-2026-81578 and CVE-2026-82078, published by NVD on 28 August — and PaperCut has shipped a second emergency patch after researchers bypassed the first. The builds named below are superseded. Read the follow-up. Nothing in the original story below has been altered.

    PaperCut has confirmed that customers are being attacked through an unpatched flaw in its NG and MF print management servers. There is no CVE. There is no entry in CISA’s Known Exploited Vulnerabilities catalog. The emergency builds that shipped overnight do not appear on PaperCut’s own release history, and the vendor says they did not go through its normal release process. If you run PaperCut, the mitigation is the response.

    What happened

    PaperCut published an urgent security bulletin on 27 August 2026 covering PaperCut NG and PaperCut MF. In the vendor’s own words, quoted identically by four outlets that read the bulletin: “We are aware of confirmed customer incidents and are treating this matter with the highest priority.” The company adds that its investigation is ongoing, and has not disclosed the vulnerability itself, the attack method, or who is behind it.

    No CVE identifier has been assigned. This matters more than it sounds: KEV entries are keyed on CVE IDs, so PaperCut’s absence from the catalog is not an oversight by CISA, it is structurally impossible until an identifier exists. Federal remediation deadlines do not attach to this yet, and may not for days.

    Be careful with the CVE search results. Two PaperCut CVEs were published on 3 August 2026 — CVE-2026-8793 (excessive authentication attempts, CVSS 6.9) and CVE-2026-8794 (a timing discrepancy enabling username enumeration, CVSS 6.9) — both fixed in 26.0.3 back in July. Neither is this flaw. At least one vulnerability database frames CVE-2026-8794 as “the August 2026 bulletin,” which invites exactly the wrong conclusion.

    PaperCut’s stated mitigation is unambiguous: “If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only.” Reporting indicates the guidance extends to taking servers offline entirely where access cannot be restricted, and that administrators should act even without evidence of compromise.

    The indicators of compromise, consistent across every outlet that read the bulletin:

    • Suspicious activity from the pc-app.exe process
    • Missing, truncated, or deleted server.log files
    • ERROR No suitable driver found for jdbc:no:x
    • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
    • IDS, EDR, or network monitoring alerts referencing the Application Server

    PaperCut also warns that the absence of these indicators does not mean a server is clean, because the attackers delete logs behind them. That is an unusually honest thing for a vendor to put in writing, and it should shape how you interpret a quiet hunt.

    The patch that isn’t quite a patch

    Emergency builds went out at approximately 2:10 a.m. AEST on 28 August, covering the version 25 and version 26 branches across Windows, Linux, and macOS. Version 24 had no fix at the time of writing.

    Four build numbers are circulating: PaperCut MF 26.0.4 build 76494, NG 26.0.4 build 76495, MF 25.0.12 build 76496, and NG 25.0.12 build 76497. Huntress lists the 25.0.12 pair; two other outlets list all four, matching exactly.

    None of these builds appear on PaperCut’s own release history pages. As of checking, NG and MF 26.0 release history still show 26.0.3 as newest, dated 28 July. The 25.0 histories still show 25.0.11, dated 5 May. PaperCut’s MF version-check page still advises upgrading to 26.0.3.

    There is a coherent explanation, and it is itself the newsworthy part. The Register reports PaperCut is distributing an emergency patch that “has not gone through our usual release process.” A second outlet carries the same characterization. These appear to be genuine out-of-band builds shipped outside the normal channel — which is why the version checker does not know about them.

    That is a defensible decision by a vendor under fire. It is also a decision whose risk you inherit when you install it: a build that skipped the usual QA, applied to a server that sits in the middle of your network.

    What exploitation actually looks like

    Huntress reports limited exploitation across two customer environments, the first on 26 August and the second on 27 August. In the first, the exploitation window lasted under two minutes.

    The observed activity: base64-encoded reconnaissance commands written into server.log — whoami & ver and whoami & ver & tasklist. Malicious Java class files recovered from an infected Windows host, named Udydn.class and Moo97.class, writing output to Udydn.out and Udydn.cmd. The tooling is OS-agnostic across Linux and Windows, and it self-deletes along with its logs. A further log artifact worth grepping for: DB URL: jdbc:derby:memory:pwn.

    Separately, and in a lab rather than in the wild, Huntress reproduced a pre-authentication remote configuration takeover and a full remote code execution chain against build 25.0.11.75758. Their description of the root cause: “A specifically crafted request can refer to one page that is rendered for the response, and another page that owns the component or action being executed,” such that “PaperCut’s authorization check could trust the rendered page and miss the permissions required by the component behind it.”

    That is an authorization-bypass-to-RCE characterization from Huntress. PaperCut has published no technical detail of its own. The “pre-auth RCE” framing in today’s headlines traces to Huntress’s lab work, not to the vendor.

    Why it matters

    Print management is one of those categories that acquires enormous privilege without anyone deciding it should. The Application Server holds credentials, reaches directory services, touches file systems across the estate, and tends to be exempted from the network segmentation applied to things people think of as sensitive.

    The 2023 precedent is the reason this is being taken seriously: CVE-2023-27350 in PaperCut MF/NG ended with Cl0p and LockBit deployments against organizations that did not move fast. No connection between that flaw and this one has been established by anyone, and searching for PaperCut attacks surfaces a great deal of 2023 attribution — Cl0p, LockBit, Lace Tempest, Iranian state-backed groups — that belongs to a different vulnerability. Nobody has named an actor in this campaign. PaperCut explicitly has not.

    One practical trap: PaperCut’s product pages currently carry an “URGENT security message for all NG/MF customers” banner. It links to a bulletin titled “URGENT MF/NG vulnerability bulletin (March 2023)” — the CVE-2023-27350 advisory. Anyone following the site’s own banner lands on a three-year-old page.

    What to do

    • Restrict Application Server web access to trusted IP ranges now, or take it off the internet. This is the vendor’s instruction and it does not depend on a build number existing, being verifiable, or having passed QA.
    • Hunt the indicators above, and treat a clean result as inconclusive. The vendor says so itself. Deleted or truncated server.log files are the signal, and their absence is not an all-clear.
    • If you apply the emergency build, do it knowing it bypassed normal release QA. That is a tradeoff to make deliberately, not a free action.
    • On version 24, there was no fix at the time of writing. Mitigation is all you have.
    • Do not follow the banner on PaperCut’s product pages. It goes to the 2023 advisory.

    Sourcing note

    PaperCut’s bulletin body does not render to automated retrieval; every vendor quotation above is taken from outlets that read it directly, and the quoted lines appear near-identically across BleepingComputer, Help Net Security, Security Affairs, and The Register. The build numbers are reported by Huntress and two other outlets and do not appear on PaperCut’s own release history pages — treat them as reported, not vendor-confirmed. The technical root-cause analysis and the exploitation observations are Huntress’s, not PaperCut’s. No CVE has been assigned. Not in CISA KEV, which requires a CVE. No threat actor has been named by anyone, and ransomware attribution found in search results belongs to the 2023 PaperCut flaw, not this one. A report that the vulnerability was discovered by a university customer’s internal security team appears in one outlet only and is not vendor-confirmed.