Ouch.
Last Updated: 2026-09-02T13:00:31Z
What’s Happening
*PaperCut has released an urgent security advisory for PaperCut NG and PaperCut MF as well as two newly discovered CVEs. This includes a Pre-Auth RCE Chain. All NG and MF versions are being considered as potentially affected, and emergency patches for versions 24, 25, and 26 have been released.
Huntress has released an incident response blog mentioning two instances of customer exploitation.
Security Advisory
Huntress Investigation
CVE-2026-82078
CVE-2026-81578
Actions
Immediately disconnect PaperCut NG and PaperCut MF services that are accessible from the internet, ensuring they can only be accessed by trusted IP addresses even if no suspicious activity has been observed. If PaperCut services were exposed publicly, ensure to backup the server/logs directory, the current configuration, process trees originating from pc-app.exe and other system logs such as scheduled tasks, services, etc.
Apply the emergency patch that has been released for customers if you are unable to take other mitigating actions. Do this if you have already applied the first patch as PaperCut has released a second, more hardened, patch.
The patched versions are:
PaperCut MF:
24.1.9(build 76534)25.0.12(build 76532)26.0.1(build 76531)
PaperCut NG:
24.1.9(build 76535)25.0.12(build 76533)26.0.4(build 76530)
Be on the lookout for any suspicious activity:
- Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from
pc-app.exe. This is the most reliable detection—shell processes that are a child of PaperCut. - Missing, unexpectedly truncated, or deleted PaperCut server.log files.
- Suspicious outbound SMB2 connections.
Udydn.outin /data/content/ path relative to the programs installation directory- Any of the following entries in server.log:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CASTd2hvYW1pICYgdmVy
Notes
PaperCut has noted that the absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance as soon as they are available. This IFIN post will be updated when further IoCs are published.
Shodan analysis for attack surface is non-trivial, since PaperCut does not make its full version immediately visible. A baseline search filter looks like:
http.favicon.hash:-1142586156 http.title:"PaperCut Login" port:9191
Now, the auth bypass is on the admin interface, which is by default on port 9191, hence the inclusion above. That interface should never be exposed to the internet.
If you’re looking at a potentially vulnerable server and want to ascertain its exact version, the easiest way I’ve found is to navigate to /app?service=page/Foobar on the port 9191 site. This brings up a not-found error that reports the full version and build number.
Based on these parameters, the attack surface is on the order of hundreds of servers. So bad, but not “widespread” exactly. Still, for organizations (mostly colleges and universities) using PaperCut, an attack could be devastating—especially because those networks tend to have lax network segmentation, and a compromised public web server could easily be a pivot point to the internal network.