CISA Flags PaperCut NG/MF Flaws: Active Exploitation and a Full Pre-Auth RCE Chain

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities affecting PaperCut NG/MF print management software to its Known Exploited Vulnerabilities (KEV) catalog. Security researchers at Huntress have not only observed real-world attacks leveraging these flaws but have also successfully reproduced a full pre-authentication remote code execution (RCE) chain against a clean installation, highlighting a severe risk to schools, hospitals, and offices worldwide. With federal agencies ordered to patch by September 14, the disclosure reveals a complex patching process and raises significant concerns for the large number of organizations running unsupported legacy versions.

The CISA KEV Catalog Addition

CISA’s KEV catalog is a critical resource for cybersecurity professionals, serving as a definitive list of known vulnerabilities that are being actively exploited in the wild. The addition of the PaperCut NG/MF flaws underscores the immediate and tangible threat they pose. Per Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate these specific vulnerabilities by the due date to secure their networks. While this directive applies to federal bodies, CISA strongly recommends that private organizations also review the catalog and prioritize patching these flaws within their own infrastructure to mitigate the risk of a data breach or malware infection.

Technical Breakdown of the PaperCut Vulnerabilities

The attack chain begins with a critical authorization flaw, tracked as CVE-2026-81578. This pre-authentication remote code execution vulnerability stems from a simple yet devastating mistake in PaperCut’s access control logic. An attacker can send a specially crafted request that tricks the server into displaying one page while simultaneously executing an action from another. The core issue is that PaperCut checks the permissions for the page it displays, not the action it actually performs. This oversight allows an unauthenticated attacker to alter the server’s configuration without ever logging in.

This initial access is then chained with a second vulnerability, CVE-2026-82078, which resides in PaperCut’s database utilities. This flaw permits the loading of unsafe Java classes, enabling the attacker to execute arbitrary Java code on the underlying server. The combination of these two vulnerabilities transforms a simple authorization mistake into a full remote code execution exploit, granting attackers the ability to run malicious code with significant privileges.

Observed Attacks and Forensic Trail

Huntress researchers first detected signs of exploitation in two distinct customer environments. Interestingly, the real-world attacks observed were relatively brief and focused on system discovery rather than full-scale destruction. One incident lasted under two minutes, with the attacker running only basic commands like whoami and ver to identify the compromised account and Windows version. A second incident added tasklist to the mix to enumerate running processes. In both cases, there was no evidence of secondary malware, deeper persistence mechanisms, or follow-up command-and-control traffic. This activity appears to be reconnaissance, the kind of initial probing that often precedes a more damaging operation.

Despite the short duration of the attacks, the forensic trail left behind is incredibly valuable for defenders. Investigators discovered a malicious Java class file dropped directly into PaperCut’s installation directory. This file was designed to execute commands, write the results to a temporary file, and then meticulously delete both the output and the server’s own server.log file to cover its tracks. However, one artifact survived the cleanup: a Derby database log entry containing the string memory:...\pwn. This oddly named database directory is now considered a high-confidence indicator of compromise (IOC) and is flagged in PaperCut’s own investigation guidance. The log line, which reads DB URL: jdbc:derby:memory:pwn, immediately followed a large encoded data blob, providing a clear breadcrumb for incident responders.

Reproducing the Exploit Chain

To confirm the severity, Huntress went a step further and reproduced the entire attack chain from scratch against a vanilla, unpatched PaperCut NG 25.0.11.75758 server. From a remote system, the researchers successfully triggered code execution without any authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges. This confirmation is critical, as it proves the vulnerability can be exploited to achieve code execution at the highest Windows privilege level, giving an attacker complete control over the affected server.

Patching Challenges and Legacy Systems

The patching process for these vulnerabilities is more complex than a simple update. PaperCut released an emergency patch initially, followed by another update less than 24 hours later after additional testing. At the time of the report, fixes for version 24 were still in development. This timing is particularly concerning because the second confirmed attack targeted a server running version 24, before a fix was available for that specific version.

The most significant concern, however, lies with older, unsupported versions. Huntress found that approximately 47% of the roughly 2,500 PaperCut installations it tracks are still running version 23 or earlier. There is currently no patch available for these legacy versions, leaving a massive number of organizations exposed to a vulnerability with a known exploit chain. For these users, the only mitigation may be to isolate the systems or upgrade to a supported version immediately.

Conclusion

The active exploitation of the PaperCut NG/MF vulnerabilities is a stark reminder of the constant threats facing modern enterprises. The successful reproduction of a full pre-authentication RCE chain demonstrates that these are not theoretical risks but practical attack vectors. While the observed attacks so far have been limited to reconnaissance, the potential for a devastating ransomware deployment or data breach is immense. Organizations running PaperCut must treat this as a critical incident, prioritize patching immediately, and thoroughly investigate their logs for the indicators of compromise detailed by Huntress. The clock is ticking, and for those on unsupported versions, the need to act is even more urgent.