ON 31 August 2026 the Cybersecurity and Infrastructure Security Agency added two newly exploited PaperCut vulnerabilities to its Known Exploited Vulnerabilities catalogue. The flaws affect PaperCut NG and PaperCut MF print‑management software and are being actively abused in the wild. Federal agencies must prioritise patching under Binding Operational Directive 26‑04, while all organisations are urged to treat the issue as urgent.
CVE‑2026‑81578 carries a CVSS v3.1 score of 8.8 and describes an authentication bypass in the PaperCut NG/MF web interface. An attacker can send crafted requests that skip login checks and gain administrative access to the server. CVE‑2026‑82078 is rated 9.4 CVSS and involves unsafe reflection in the database connector component. By manipulating configuration parameters an intruder can load and execute arbitrary Java bytecode that runs with the privileges of the PaperCut process.
Researchers from Huntress and Rapid7 first observed active exploitation of CVE‑2026‑81578 on 27 August 2026, with attackers using the bypass to run remote code without authentication. Subsequent analysis showed that CVE‑2026‑82078 is being chained in some attacks to alter server settings and deploy further payloads. Despite the publicity, a recent scan found that roughly 47 % of exposed PaperCut instances remain unpatched, primarily in North America and Europe (SecurityAffairs). Attackers have been seen conducting reconnaissance rather than immediate ransomware deployment, leaving forensic traces that can aid defenders.
PaperCut issued emergency updates on 27 August 2026, advising administrators to upgrade to version 24.1.10, 25.0.13 or 26.0.5 to address both flaws (vendor advisory). The company also recommended limiting web‑access to trusted IP addresses and disabling the administrative interface where possible. Initial patches reduced successful exploitation but some bypass attempts continued, prompting a second update a few days later. Administrators are encouraged to verify the patch level via the built‑in version check or the vendor’s security advisory.
Separate tracking by security researchers indicates that approximately 1,000 PaperCut systems remain exposed on the internet, mainly in North America and Europe, which raises concerns about potential ransomware encryption of print queues (SecurityWeek). The presence of unpatched hosts expands the attack surface for threat actors seeking footholds inside corporate networks. Organizations that rely on PaperCut for pull‑printing or audit logging should therefore prioritise asset discovery and isolation.
Defenders should apply the latest PaperCut releases as soon as possible and isolate any internet‑facing servers that cannot be updated immediately. Reviewing web‑server logs for unexpected POST requests to the /admin/rpc/servlet endpoint can help detect authentication‑bypass attempts. Monitoring Java reflection activity, such as calls to Class.forName with user‑controlled input, may reveal exploitation of the unsafe‑reflection flaw.
Applying network segmentation and enforcing least‑privilege service accounts limits the impact if a breach occurs. Subscribing to the CISA KEV feed ensures timely notice of similar high‑risk issues, and maintaining an up‑to‑date asset inventory accelerates remediation.
While Binding Operational Directive 26‑04 binds federal civilian agencies to act on KEV entries, the guidance serves as a useful benchmark for private sector teams. Keeping assets current and maintaining vigilant monitoring remain the most effective defences against actively exploited zero‑days.