Two flaws in PaperCut NG and MF print management software, fixed last week after zero-day use, are now being exploited for database theft rather than only remote code execution. The chain pairs CVE-2026-81578 and CVE-2026-82078 for authentication bypass leading to code execution, while in-the-wild activity hijacks external user-lookup to dump tables via Derby. More than 70,000 organizations running the platform are affected, with over 800 servers still visible online.
How the flaws work
According to NVD detail for CVE-2026-81578 and NVD detail for CVE-2026-82078, the pair can be linked to get past login checks and then execute code on PaperCut NG and MF print management servers.
The NVD description, dated Aug 28, 2026, characterizes CVE-2026-81578 as an improper access control issue in the web management interface of PaperCut MF and PaperCut NG, where in certain cases remote requests without authentication aimed at administrative functions can cause backend operations to run before access validation finishes. Enrichment context is tracked in the CISA vulnrichment record.
PaperCut Software reports its software is deployed for 100 million users across more than 70,000 organizations, spanning large companies, state agencies, and educational institutions.
Data-theft exploitation observed
Threat intelligence company Defused reported over the weekend that abuse had started in live environments. The firm noted sightings in its honeypots beginning late yesterday UTC (Aug 29th) for CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF).
Instead of following the RCE route described in public writeups, the operator in those sightings misuses the auth bypass to take over PaperCut's external user-lookup function. That path is then used for information stealing focused on dumping DB tables via Derby.
Internet security watchdog Shadowserver currently tracks over 800 PaperCut MF and NG servers exposed online, with no information available on how many of those are honeypots or have already been secured against these attacks.
Vendor status, described in initial zero-day warning coverage and second emergency patch coverage, is that indicators of compromise have been published to assist defenders in blocking ongoing attacks. Attribution has not been provided, and no explanation has been given of post-compromise activity by the threat actors beyond what external observers reported.
Active exploitation status is reflected by CISA action on Aug 31, 2026, when CISA added vulnerabilities including CVE-2026-81578 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation, per the CISA KEV alert.
Emergency patches and mitigation
PaperCut Software issued three sets of emergency patches on Thursday, Friday, and Tuesday to deliver protections quickly to clients unable to take servers off the internet.
PaperCut CEO Chris Dance said today the initial shipment was an urgent stopgap, the following shipment introduced extra hardening as the team learned more, more fixes remain underway, additional Emergency Patch releases could follow if needed, and a final fully QA and regression-tested official release would arrive soon.
Guidance is for every customer operating internet-facing Application Servers to deploy Release 3 promptly, even where an earlier emergency release is already in place. Details on Emergency Patch Release 3 were added September 01, 07:27 EDT.
Defenders should prioritize removing management interfaces from public reach, applying Release 3, and hunting with the vendor IOCs. No detection commands or file, hash, IP, or domain indicators beyond the vendor IOC set and the Derby table-dumping behavior were included in the supplied material.
Past PaperCut exploitation history
State-backed hacking groups and ransomware gangs have both targeted PaperCut security flaws in the wild over the last several years.
In April 2023 attacks, a critical remote code execution vulnerability (CVE-2023-27350) and a high-severity information disclosure flaw (CVE-2023-27351) were chained in operations linked to the LockBit and Clop ransomware gangs, as detailed in reporting on Clop and LockBit PaperCut hacks.
Microsoft disclosed two weeks later that the Muddywater and APT35 Iranian state-backed hacking groups had also joined the attacks, covered in Microsoft reporting on Iranian groups, with background on Muddywater links in US linkage of Muddywater to Iranian intelligence and related sanctions reporting. At that time the company said the groups misused the Print Archiving feature designed to save all documents sent through PaperCut printing servers.
One month later, in May 2023, the FBI and CISA warned that the Bl00dy Ransomware gang had also begun exploiting the CVE-2023-27350 flaw for initial access to targets' networks, per FBI warning on Bl00dy Ransomware.
The Cybersecurity and Infrastructure Security Agency (CISA) flagged another remote code execution vulnerability (CVE-2023-2533) as actively exploited in July 2025, per CISA flagging of PaperCut RCE.
Technical background — general concepts only
This section is general educational context about this vulnerability class, not specifics of this incident. No exploit code, version strings, IOCs, or URLs below apply to CVE-2026-81578 or CVE-2026-82078.
Improper access control in a management interface often means privileged logic runs before identity is confirmed. A generic defensive check is to verify what is listening publicly and restrict it:
# GENERIC example only - illustrate exposure review, not this incident
ss -tlnp | grep -E ':80|:443|:9191|:9192'
# restrict admin interface to internal networks via firewall / VPN
External user-lookup integrations and embedded databases like Derby expand impact if abused, because lookup functions may query directory services and database tables containing accounts, jobs, and documents. Generically, operators reduce risk by disabling unneeded external lookups, limiting service accounts to least privilege, and keeping offline backups of configuration and database exports for recovery comparison.