A Familiar Target for Ransomware Crews Is Under Fire Again
PaperCut, the print management software running inside a large share of enterprise, education, and government print environments, alerted customers that attackers are actively exploiting a vulnerability affecting every version of PaperCut NG and PaperCut MF. The company said it is aware of confirmed customer incidents and is treating the matter with the highest priority while its investigation continues. This is not PaperCut's first brush with mass exploitation. In 2023, a critical flaw tracked as CVE-2023-27350 was exploited by Russian state actors and by the financially motivated group Lace Tempest to deliver Cl0p and LockBit ransomware across hundreds of organizations.
The company's initial guidance focused on indicators of compromise rather than a root cause, including intrusion-detection alerts tied to the PaperCut Application Server, suspicious activity from the process pc-app.exe, and missing or truncated server.log files. PaperCut urged customers running internet-facing instances to immediately restrict access to trusted IP addresses using firewall rules or network access controls, adding pointedly: "Take this action now, even if you have not observed suspicious activity." That is not boilerplate advice. It is language a vendor uses when it knows exploitation is already ahead of patch adoption.
Two Flaws Chained Into One Unauthenticated Exploit
Huntress researchers John Hammond and Andrew Brandt later detailed the mechanism behind the attacks. The flaw gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which can be used to execute arbitrary Java code inside the application's process. The underlying bug lets a specifically crafted request reference one page for rendering while a separate page owns the component actually being executed, and PaperCut's authorization check trusts the rendered page rather than checking permissions on the component behind it. PaperCut has since disclosed the two CVEs formally: CVE-2026-81578, an access control flaw in the web management interface rated 8.8, and CVE-2026-82078, a dynamic class loading flaw in the database connection utilities rated 9.4.
Jake Knott, head of threat intelligence at watchTowr, explained the chain plainly to The Hacker News: "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution." That is the entire attack path, an unauthenticated request that bypasses login, followed by a configuration edit that loads an arbitrary, unvalidated database driver class. Knott added that PaperCut is a prime target precisely because it sits as an internet-facing pivot into a corporate network while also functioning as a repository of sensitive printed documents worth stealing in its own right.
A Second Patch, and Bypasses That Outran It
PaperCut's first emergency patch did not hold. Huntress reported a bypass to that initial fix, prompting the vendor to release a second emergency patch for versions 24, 25, and 26 that it describes as including additional hardening beyond the original fix. Huntress said its analysis of the new patch shows real security improvements against parts of the attack chain as the firm understands it, a carefully qualified endorsement rather than an all-clear. watchTowr went further, saying it discovered multiple bypasses of the first patch along with an additional authentication bypass vulnerability, and that one of those bypasses was remediated in the second emergency patch.
The part that should worry defenders most is what came after. watchTowr says it has already identified new patch bypasses affecting the latest, fully patched version, meaning organizations that raced to apply the second emergency fix may still be exposed to a variant of the same exploit chain. PaperCut has not published details about the nature of the malicious activity weaponizing the flaws or who is behind it, leaving defenders to rely on indicators of compromise and third-party research rather than a definitive vendor account of the threat.
What the Attackers Are Actually Doing Once They Are In
Huntress has observed limited exploitation on two customer environments, giving a concrete look at post-exploitation behavior. Attackers execute base64-encoded commands to identify the victim's user account and operating system, chaining whoami and ver, and in one incident recorded on August 27 also ran tasklist to capture the list of running processes. A Java class file deployed as part of the attack is operating system agnostic and can fingerprint the machine and list files on disk under either Windows or Linux, writing its output to a file before deleting both that output file and the server's own log files to hinder forensic reconstruction.
The broader indicators PaperCut and Huntress have shared point toward a deliberate, hands-on-keyboard intrusion rather than an automated worm. Observed activity includes execution of a SimpleHelp remote access binary run as a Windows service, and installation of AnyDesk through a straightforward PowerShell download command aimed at establishing persistent remote access. John Hammond told The Hacker News the firm still lacks enough evidence to determine the attackers' ultimate goal, describing the activity observed so far as consistent with early-stage reconnaissance or validation rather than immediate ransomware deployment.
The Only Reliable Mitigation Right Now
Given that patch bypasses have outpaced two rounds of emergency fixes, both Huntress and watchTowr converge on the same recommendation: remove PaperCut Application Server from public internet exposure entirely, rather than treat the latest patch as sufficient on its own. Knott's guidance to customers is explicit: restrict PaperCut Application Server web access to trusted IP addresses, or place it behind a VPN or another controlled administrative path, and begin actively hunting for compromise indicators such as the database error strings PaperCut and Huntress have published from server.log.
For enterprise security teams, the PaperCut episode is a reminder that a vendor's second emergency patch is not automatically the end of an incident, particularly when independent researchers are actively hunting for bypasses in parallel with the vendor's own hardening work. Given the software's history with Cl0p and LockBit in 2023, any organization still running an internet-exposed PaperCut instance should treat network segmentation, not patch level, as the control that actually determines whether this becomes a contained vulnerability or the entry point for a ransomware event.
