PAPERCUT’S AUTHENTICATION GAP RETURNS: TWO-MINUTE RCE CHAIN HITS 70,000 ORGANIZATIONS

# PaperCut’s Authentication Gap Returns: Two-Minute RCE Chain Hits 70,000 Organizations

The PaperCut NG/MF pre-authentication remote code execution chain—tracked as CVE-2026-81578 and CVE-2026-82078—is not an isolated software failure. It is a structural indicator of a persistent authentication gap pattern that security researchers have observed across AI middleware, Cisco management planes, and Microsoft SSPR. When 70,000 organizations rely on a single print management platform, the intersection of complex framework dependencies and exposed management interfaces creates a predictable, high-value target for attackers.

This latest vulnerability chain represents a direct continuation of a troubling trend: the perimeter defense fails to account for the underlying complexity of the application’s request handling. The result is a devastating two-minute exploit chain that grants attackers arbitrary code execution on vulnerable PaperCut servers, with post-exploitation activity already observed in the wild.

## The Mechanics of the Two-Stage Exploit Chain

The attack relies on a sophisticated two-stage exploit chain that demonstrates the evolving sophistication of modern hacking techniques. First, CVE-2026-81578 provides an authentication bypass via Apache Tapestry page confusion, specifically targeting the framework’s complex direct request format. This vulnerability allows attackers to circumvent the authentication layer entirely, gaining access to restricted functionality without valid credentials.

Once the authentication layer is circumvented, the attacker leverages CVE-2026-82078 to perform unsafe dynamic class loading. By modifying the application configuration, the attacker forces the server to load a malicious JDBC driver. This results in arbitrary Java bytecode execution under the context of the PaperCut server process. The combination of these two vulnerabilities creates a complete pre-authentication remote code execution chain that requires no user interaction and no valid credentials.

Huntress researchers John Hammond and Andrew Brandt confirmed the pre-auth RCE chain against stock PaperCut NG 25.0.11.75758. Their research demonstrated that the exploit works reliably against unpatched installations, and the attack sequence—from initial bypass to code execution—completes in under two minutes. This speed defines the current threat landscape, where automated exploitation tools can compromise vulnerable systems faster than administrators can respond.

## Speed and Scale of Active Exploitation

The timeline of this incident reveals how quickly threat actors move once a vulnerability is disclosed. Huntress observed exploitation beginning August 26, 2026, with the PaperCut advisory following on August 27. This means attackers were actively exploiting the vulnerability before the vendor even issued a public advisory—a pattern that has become increasingly common in the cybersecurity landscape.

Post-exploitation activity is equally rapid and standardized. Attackers have been observed installing SimpleHelp agents as a LocalSystem Remote Access Service, deploying AnyDesk for persistent remote access, and conducting reconnaissance using standard system utilities like whoami, ver, tasklist, and nltest. This standardized post-exploitation toolkit suggests that multiple threat actors are using the same exploit chain, likely sharing techniques through underground forums and automated exploit frameworks.

Rapid7’s Stephen Fewer has already published a Metasploit module to validate exposure, further lowering the barrier for entry. This means that even relatively unskilled attackers can now leverage this vulnerability chain with minimal effort, dramatically increasing the potential for widespread exploitation.

## A Pattern of Authentication Gaps Across Infrastructure

This incident is a direct continuation of the authentication gap pattern observed across diverse infrastructure layers. Like the prior CVE-2023-27350, which also involved an authentication bypass and RCE in the same product line and was subsequently exploited by ransomware operators, the current chain highlights a failure to secure the management plane.

Whether it is AI middleware, network management interfaces, or print servers, the pattern remains consistent: attackers identify a bypass in the authentication logic, gain access to the underlying framework, and execute code with elevated privileges. The infrastructure layer is increasingly becoming the primary pivot point for corporate environment compromise, as these systems often have elevated privileges and access to sensitive data.

The risk is compounded by a significant legacy footprint. Huntress data indicates that 47% of approximately 2,500 tracked PaperCut installations are running version 23 or older. These versions lack available patches, leaving nearly half of the monitored environment effectively unpatchable and permanently exposed. This creates a massive, static attack surface that remains vulnerable regardless of vendor advisories.

## CISA Warning and Urgent Remediation

The urgency of this situation is underscored by CISA’s inclusion of these vulnerabilities in the Known Exploited Vulnerabilities catalog on August 31, with a remediation deadline of September 14. This federal warning indicates that the exploitation is active and poses a significant threat to government and private sector networks alike.

Remediation requires immediate action. Organizations must move to Emergency Patch Release 3, released September 1, which supersedes all prior patches for versions 24, 25, and 26. For those unable to patch, isolation of the print server from the internet is the only viable mitigation. Administrators should also audit legacy installations for indicators of compromise, specifically looking for the string “jdbc:derby:memory:pwn” in server logs, unexpected .class files within the server/lib directory, and suspicious child processes spawned by pc-app.exe.

WatchTowr’s discovery of bypasses in initial emergency patches serves as a reminder that partial fixes are insufficient. The security research community has repeatedly demonstrated that incomplete patches can create new attack vectors, and organizations must verify that their remediation efforts are comprehensive.

## The Broader Implications for Security Practitioners

The implications of this vulnerability extend beyond simple patching. As Jake Knott of watchTowr noted, “PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated.”

The combination of internet-facing management interfaces and the potential for data exfiltration makes these systems high-priority targets. The second wave of attacks, which demonstrated more sophisticated post-compromise behavior, confirms that threat actors are actively refining their tactics against unpatched infrastructure.

## Conclusion: A Systemic Issue, Not a Product-Specific One

The PaperCut incident confirms that the authentication gap is a systemic issue, not a product-specific one. When management infrastructure is exposed, the complexity of the underlying frameworks—such as Apache Tapestry—becomes a liability. Security practitioners must shift their focus from individual CVEs to the broader pattern of management plane exposure.

Until organizations address the fundamental accessibility of these critical services, they will remain vulnerable to rapid, automated exploitation chains that bypass traditional perimeter defenses. The two-minute RCE chain against PaperCut is not an anomaly; it is a warning about the future of cybersecurity threats. The question is not whether your organization will face a similar attack, but whether you will be prepared when it happens.