PaperCut Zero-Day Chain Exploited Before Patch Even Existed

A print server becomes a front-line target

One of the most consequential zero-day stories to break in recent memory did not begin with a research paper or a conference talk. It began with an admission from a vendor that attackers were already inside customer networks. On August 27, 2026, PaperCut Software confirmed that PaperCut NG and PaperCut MF, its widely deployed print-management products, were being actively exploited, and that it had "confirmed customer incidents" tied to the activity 10. Crucially, Huntress researchers say they had already observed exploitation in the wild starting August 26 — a full day before PaperCut's public advisory went live 1519. That sequencing is the defining feature of this incident: defenders were reacting to attacks that were already underway, with no broadly available fix and minimal public detail about what was actually being exploited.

What looked initially like a single flaw turned out to be two vulnerabilities chained together for maximum effect. PaperCut, along with Huntress and watchTowr, determined that attackers were combining an authentication-bypass bug with an unsafe code-loading flaw to achieve remote code execution without ever needing valid credentials 1120.

Two flaws, one devastating chain

The first vulnerability, CVE-2026-81578, carries a CVSS score of 8.8 and stems from improper access control in PaperCut's web-management interface. Under certain conditions, unauthenticated requests aimed at administrative functions can trigger backend actions before the system finishes validating access permissions — effectively letting an outsider edit server configuration without logging in 1015. Huntress explained the underlying flaw memorably: PaperCut's authorization logic trusted the page being rendered to the user rather than checking permissions for the component actually doing the work behind it 1119.

The second vulnerability, CVE-2026-82078, is rated 9.4, critical. It involves how PaperCut's database-connection utilities load driver classes based on configurable names, without validating those names against an approved list. An attacker who can manipulate that configuration can force the server to execute arbitrary Java bytecode under the PaperCut server process's own privileges 1015.

Neither bug alone is catastrophic on its own terms, but together they form a pre-authentication remote-code-execution chain: the access-control flaw hands an anonymous attacker the ability to rewrite configuration, and the unsafe class-loading flaw turns that configuration control into arbitrary code execution 1115. watchTowr's Jake Knott summarized the mechanics plainly, saying CVE-2026-81578 bypasses authentication and from there an attacker edits a configuration file to trigger CVE-2026-82078 and obtain code execution 11.

From reconnaissance to hands-on intrusion

Huntress initially reported evidence of exploitation in two customer environments, describing the observed behavior as largely reconnaissance: attackers ran Base64-encoded commands like whoami & ver, and in at least one case added tasklist to enumerate running processes 111219. A recovered Java class file was used to profile the compromised system, write results to a file, and then delete both that file and PaperCut's own server logs to cover tracks 12.

But the picture escalated quickly. Later reporting from SecurityWeek, citing watchTowr, described attackers moving from automated probing to genuine hands-on-keyboard activity, exploring systems they had already compromised 18. Help Net Security detailed a broader post-exploitation playbook: enumerating users and privileges, mapping domain controllers, listing logged-in sessions, and then pulling down and silently installing SimpleHelp remote-access software configured to auto-start, followed by a second, redundant remote-access channel via AnyDesk 16. Separately, BleepingComputer reported a threat researcher observing a different pattern altogether in honeypot data — an actor abusing the authentication bypass specifically to hijack PaperCut's external user-lookup feature and dump database tables via Derby, suggesting data theft rather than pure reconnaissance 17. Huntress, for its part, said it had not observed secondary malware or additional persistence mechanisms in the cases it examined directly 19. Taken together, the coverage does not fully agree on how far attackers pushed in any given environment, but it agrees that the threat evolved rapidly and that intentions ranged from discovery to remote-access deployment to possible data exfiltration.

A patch that needed a patch

Perhaps the most telling detail in this story is that PaperCut's first fix did not hold. The company shipped an initial emergency patch for the v25 and v26 branches on August 28 15. Within the same window, Huntress and watchTowr identified bypasses in that patch, prompting PaperCut to release "Emergency Patch Release 2," which added further hardening and was recommended even for customers who had already applied the original fix 101320. Release 2 eventually extended coverage to the older v24 branch as well 1016.

Even then, the story did not close cleanly. watchTowr publicly stated it was continuing to work with PaperCut to resolve additional bypasses in the released patches, warning that the situation remained fluid and that patches were being issued iteratively 13. That is an unusual level of transparency about an unresolved fix, and it underscores a theme that runs through nearly every source: applying an emergency patch could not be treated as the end of incident response.

Official recognition and remaining exposure

On September 1, CISA formally added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog, an action the agency reserves for flaws with confirmed evidence of real-world exploitation 1418. That listing triggers remediation obligations for federal civilian agencies under Binding Operational Directive 26-04, which requires prioritized patching of high-risk, internet-exposed assets and consideration of whether systems were compromised before a fix was applied 14.

The scale of potential exposure remains significant. SecurityWeek cited ShadowServer data showing more than 1,000 PaperCut NG/MF instances directly reachable from the internet 18. Huntress separately noted that roughly 47% of the roughly 2,500 PaperCut installations it tracks are still running version 23 or older — branches that, as of the second emergency patch, had no available fix, leaving administrators dependent on network isolation rather than patching 16.

The broader disclosure debate

This incident lands amid wider industry friction over how zero-days should be surfaced. Separate reporting has chronicled Microsoft's public objections to uncoordinated disclosure, following a researcher's release of half a dozen unpatched Windows flaws — including bugs affecting Defender and BitLocker — without advance vendor coordination 3468. Microsoft has argued that coordinated vulnerability disclosure protects customers by giving vendors time to build and test fixes before details become public 36. Critics counter that disclosure and patch timelines are already too slow relative to how quickly attackers move once flaws become known, with one analysis pointing to a case involving six zero-days since April where Microsoft only patched some issues after they were added to CISA's KEV list 7. Industry data lends weight to that urgency: Rapid7 has found that a majority of zero-day cases are exploited within one to two weeks of disclosure 5, while VulnCheck data cited by Infosecurity Magazine found that nearly 29% of known exploited vulnerabilities last year were attacked before public disclosure or on the very day they were reported 9. The PaperCut episode, in which exploitation preceded the vendor's own advisory, sits squarely inside that troubling pattern. Meanwhile, initiatives like Trend's Zero Day Initiative continue to coordinate disclosures with vendors ahead of public release 2, and even AI-assisted vulnerability discovery tools are now entering the pipeline, as with Intruder's automated system that recently surfaced a previously unknown WordPress plugin flaw 1 — a reminder that the volume and speed of zero-day discovery is only accelerating on both the offensive and defensive sides.

Bottom line

The PaperCut incident is a compact case study in what modern zero-day risk actually looks like: exploitation beginning before public disclosure, an emergency patch that itself required patching, active post-compromise activity ranging from reconnaissance to remote-access tool deployment, and a federal cybersecurity agency formally validating the danger through its KEV catalog. For organizations running PaperCut NG or MF, and for the wider industry watching how disclosure and patching intersect under real attacker pressure, the lesson is that a released patch is a milestone, not a finish line.