Chained PaperCut flaws let unauthenticated requests load attacker Java into the server process

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and PaperCut MF to execute arbitrary code on susceptible instances.

CVE-2026-82078 (CVSS 9.4): an unsafe dynamic class loading vulnerability in the database connection utilities of PaperCut MF and NG; the application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.

CVE-2026-81578 (CVSS 8.8): an improper access control vulnerability in the web management interface of PaperCut MF and NG; under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.

PaperCut, an Australian company, released a second emergency patch that it said includes additional hardening beyond the original emergency patch.

watchTowr said attackers are chaining together both vulnerabilities to bypass authentication and gain remote code execution on affected instances.

Huntress said it has observed limited exploitation in two customer environments, with attackers executing Base64-encoded commands on the targeted server, using a chained command "whoami & ver" to determine the user account and operating system.

In an incident recorded on August 27, 2026, threat actors used a different version of the .class file running "whoami & ver & tasklist" to also capture the list of running processes.

Organizations running PaperCut NG and MF are advised to remove public exposure immediately, apply the patch as soon as possible, and restrict PaperCut Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path.

The attack deploys a Java .class file that is operating system agnostic and can run commands under Linux or Windows to fingerprint the machine and obtain a directory listing, writing the data to a file named "Udydn.out" in a "/data/content/" path relative to the program's installation directory.

After collection, the .class file deletes "Udydn.out", the server's "server.log" file, and a "/data/internal/derby.log" file.

Jake Knott, head of threat intelligence at watchTowr, said PaperCut is a prime target because it is both an internet-facing pivot into a corporate environment and a sensitive information treasure trove if printed documents can be stored and exfiltrated.

The higher CVSS score in the pair, 9.4, is assigned to the class loading flaw, while the flaw that removes the authentication requirement is scored 8.8.

In the chain watchTowr describes, CVE-2026-81578 supplies the unauthenticated write to server configuration and CVE-2026-82078 converts a configuration value, the database driver name, into a class the server loads and runs.

Because the payload deletes the PaperCut server.log and derby.log files, absence of entries in those logs cannot be used to rule out compromise on an exposed instance.

watchTowr said it also discovered multiple patch bypasses and an additional authentication bypass vulnerability, all of which are likely to have been addressed as part of the second emergency patch.

PaperCut has yet to share details about the nature of the malicious activity weaponizing the flaws.

Both disclosed flaws are exploitable expressions of one authorization design in which permission checks bind to the rendered page rather than the executed component, and watchTowr's discovery of further bypasses indicates other component and action pairs remain candidate paths.