PaperCut Software has released a second emergency patch after confirming that attackers exploited two zero-day vulnerabilities in its NG and MF print management products. The flaws can be abused by unauthenticated attackers to bypass authentication and achieve remote code execution on affected PaperCut instances.
The two issues are tracked as CVE-2026-81578 and CVE-2026-82078. CVE-2026-81578 is a high-severity authentication bypass that lets a remote attacker modify certain system configurations, while CVE-2026-82078 is a critical weakness tied to unsafe dynamic class loading in the database connection utilities.
PaperCut said that if an attacker can manipulate system configuration parameters, arbitrary Java bytecode on the application classpath may execute under the security context of the PaperCut server process. The company first issued a security bulletin on August 27, then released an emergency patch on August 28 for versions 25 and 26, followed by a second patch later the same day to add more hardening, including support for version 24.
Security firms monitoring the exploitation, including Huntress and WatchTowr, helped clarify that the incident involved two zero-days rather than one. WatchTowr said it found multiple patch bypasses and an additional authentication bypass flaw, which appears to have driven the need for the second emergency release. Huntress reported attacks against at least two customers, with the first exploitation attempts seen on August 26. The observed activity has so far focused on system discovery, and investigators have not seen secondary malware, command-and-control traffic, or signs of persistence from the recovered payload.
PaperCut continues to update its advisory and is still working on a full official release that patches both vulnerabilities. The vendor also published indicators of compromise, giving defenders additional artifacts to search for across exposed systems. The wider risk is significant because PaperCut has been targeted before, and CISA’s Known Exploited Vulnerabilities catalog already includes three other PaperCut flaws, two of which were used in ransomware attacks. ShadowServer data suggests roughly 1,000 PaperCut instances are exposed on the internet, with most located in North America and Europe, making timely patching and exposure review essential for organizations running these print management platforms.
Read the original article: