**PaperCut** has issued a critical second emergency security update for its **PaperCut NG** and **MF** print management software. This comes after researchers identified several methods to bypass the initial patches, revealing persistent vulnerabilities that were already being exploited in zero-day attacks. Initially, **PaperCut** warned of active exploitation but withheld specific **CVE** identifiers and technical details during its investigation. Now, the company has disclosed two vulnerabilities, **CVE-2026-81578** and **CVE-2026-82078**, which can be chained to achieve authentication bypass and remote code execution (RCE) on affected servers. ### Unpacking the Vulnerabilities **CVE-2026-81578** is an authentication bypass flaw with a high severity rating of 8.8. It affects the **PaperCut NG/MF** web management interface. **PaperCut** explains that "Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks." The second vulnerability, **CVE-2026-82078**, is a critical unsafe dynamic class-loading flaw, rated 9.4, found in **PaperCut's** database connection utilities. This vulnerability allows the application to load database driver classes based on configurable names without proper validation against an approved allowlist. This means "If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process," according to **PaperCut**. Cybersecurity firm **watchTowr**, which has collaborated with **PaperCut** on this incident, confirmed that these vulnerabilities enable unauthenticated attackers to bypass authentication and achieve RCE on vulnerable **PaperCut NG/MF** instances. ### The Need for a Second Patch **PaperCut** released Emergency Patch Release 2 after further analysis conducted with its internal security team and external researchers from **Huntress** and **watchTowr**. This updated fix includes additional hardening measures not present in the original emergency patch. **watchTowr** researchers successfully reproduced the vulnerabilities, discovered multiple patch bypasses, and identified an additional authentication bypass flaw, prompting the need for the second release. **Huntress** also reported observing exploitation in two customer environments and successfully reproducing the full pre-authentication RCE chain. **Huntress** noted that **PaperCut** logs captured attacker commands used for system reconnaissance. Hex-encoded Java `.class` files found in the logs acted as an RCE bridge, facilitating command execution and file manipulation on the underlying operating system. Interestingly, the observed commands primarily focused on reconnaissance rather than deploying malware or establishing persistence. ### Immediate Action Required Emergency Patch Release 2 is available for **PaperCut NG** and **MF** versions 24, 25, and 26 across Windows, Linux, and macOS. Customers running version 23 or earlier are strongly advised to upgrade to the latest patched version. **PaperCut** also stresses that Site Servers and secondary/print servers must be updated. Other components like **Print Deploy** and **Mobility Print** are not affected. Even with the patches, **PaperCut** urges customers to restrict access to web interfaces to trusted IP addresses using firewall rules or network access controls. Administrators should also monitor for suspicious post-exploitation activity from the `pc-app.exe` process, missing or truncated `server.log` files, and specific error messages within the `server.log`: **PaperCut** has not yet disclosed the identity of the threat actors or their post-compromise activities, stating that the attacks appear limited and targeted. The company is withholding details to avoid complicating affected customers' response efforts and will publish verified indicators of compromise as they become available. This incident echoes previous attacks in 2023, where **PaperCut** servers were targeted via **CVE-2023-27350**, an authentication bypass and RCE vulnerability. Those attacks were linked to various threat actors, including **Clop** and **LockBit** ransomware operations, Iranian state-backed hacking groups, and the **Bl00dy Ransomware Gang**.