What happened
On 31 August 2026, CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities Catalog, confirming active exploitation. CVE-2026-81578 permits unauthenticated changes to selected PaperCut NG/MF configuration settings, while CVE-2026-82078 can execute arbitrary Java bytecode when an attacker controls relevant database-connection parameters. Huntress and Rapid7 reproduced a pre-authentication remote-code-execution chain in the PaperCut Application Server.
At 4:22 a.m. America/New_York on 1 September 2026, PaperCut published Emergency Patch Release 3 for versions 24, 25 and 26, superseding Release 2 and the original emergency patch. PaperCut said Release 3 fixes broken SAML login flows, restores support for legacy Microsoft SQL Server drivers used for external card lookup, and adds hardening against additional attack chains observed in the wild. Systems that received either earlier emergency release still require Release 3.
Huntress observed one exploitation event on 26 August 2026 and a second on 27 August 2026. The observed base64 string d2hvYW1pICYgdmVy decodes to the command whoami & ver. On Windows, recovered files included Udydn.class and Moo97.class under C:\Program Files\PaperCut MF\server\lib, while related five-character .cmd and .out files were designed for the server\data\content directory. Huntress saw discovery activity but no secondary malware, additional command-and-control traffic or persistence in the recovered cases.
PaperCut published server.log strings including DB URL: jdbc:derby:memory:pwn;create=true, Database error looking up cardID: VALUES CAST(X’cafebabe and DB URL: jdbc:no:x DB Driver: <5-char random name>. The vendor also identified pc-app.exe or pc-app spawning child shells such as cmd.exe and running whoami & ver. Attackers may delete the five-character files and server.log, so absence does not exclude compromise. PaperCut advises immediate restriction of public web access to trusted IP addresses only, even where suspicious activity has not been observed previously or current service availability appears normal to administrators and users observing the platform externally from standard business workflows today across the organisation’s managed estate and connected infrastructure boundaries during validation and evidence preservation activities before patching begins on any exposed host system in production or administrative environments subject to change controls and emergency response approval processes overnight or this morning as teams begin coordinated containment, forensic capture and remediation workstreams while maintaining essential printing services for dependent business units without losing relevant volatile evidence needed to distinguish attempted exploitation from successful execution and subsequent attacker actions that may have occurred before restrictions were applied by infrastructure teams responsible for network segmentation and application administration under the incident command structure established for this response effort as approved by leadership and legal counsel where required by policy and regulatory obligations applicable to the organisation and its customers, employees, partners and other stakeholders who could be affected if further evidence establishes compromise or data access beyond currently published observations and indicators available from the vendor and responding research teams cited in this edition today for operational use by defenders and decision owners accountable for risk acceptance, remediation quality and evidence-based closure after all affected assets have been identified and validated through independent technical checks rather than relying solely on patch-management dashboards or self-reported configuration status that may not capture unmanaged, inherited, dormant, test, disaster-recovery or externally hosted PaperCut installations still reachable from untrusted networks and therefore requiring immediate investigation under the same response standard as known production servers because the advisory treats all PaperCut NG and PaperCut MF versions as potentially affected until upgraded, isolated and assessed for compromise using the published evidence sources and surrounding endpoint, network and identity telemetry retained by the organisation or its service providers for the relevant exposure period and any subsequent administrative activity associated with emergency patch installation, rollback or service restoration procedures performed since the issue was first disclosed publicly and defenders began altering application state across the enterprise environment under accelerated change windows that may complicate retrospective analysis if original logs, file metadata and process evidence were not preserved before intervention by administrators acting in good faith to reduce immediate exposure and restore expected service functionality following the successive emergency releases published by PaperCut during the response period covered in this briefing and the preceding weekend when many teams may have already installed Release 1 or Release 2 and considered remediation complete before Release 3 superseded those builds shortly before publication of this edition, creating a renewed need to verify installed versions, update change records, retest SAML and card-lookup dependencies and reopen incident decisions that had been closed solely on the basis of an earlier emergency patch whose security hardening and functional behaviour no longer represent the vendor’s current supported response baseline for internet-facing PaperCut Application Servers in versions 24, 25 and 26 while customers using version 23 or earlier must plan an upgrade or maintain effective isolation because no emergency patch for those older branches is identified in the cited advisory and their continued operation therefore requires an explicit, time-bound exception with accountable ownership and compensating controls capable of preventing access from untrusted sources while preserving necessary internal business use and collecting sufficient monitoring evidence to detect attempted exploitation or abnormal child-process execution originating from pc-app.exe or the corresponding pc-app process on non-Windows systems under review by the response team during this urgent remediation cycle and any subsequent assurance testing conducted before the server is returned to its normal network placement or administrative access model after change validation confirms that the correct release was installed successfully and dependent authentication or external card-lookup workflows operate as expected without reopening the vulnerable path or introducing unreviewed workarounds that bypass the protections established by the current emergency release and associated configuration requirements published by the vendor for affected customers using specialised integrations within their print-management environment at this time as the investigation remains active and additional verified information may still be published after the edition cutoff requiring another reassessment by the designated decision owner and incident commander if it changes affected versions, observed attack chains, indicators, remediation instructions or evidence needed to support closure of individual servers and the enterprise-wide response programme governing this vulnerability and confirmed exploitation activity across the organisation’s technology estate and relevant managed service dependencies today under the emergency operating posture established by leadership in response to the CISA KEV addition and PaperCut Release 3 publication described above with precise dates, versions and operational artefacts preserved in this record for future intelligence correlation and audit review by authorised teams responsible for vulnerability management, incident response, infrastructure security, regulatory compliance, risk governance and executive reporting throughout the lifecycle of this event and its eventual closure once sufficient evidence demonstrates both successful remediation and absence or containment of compromise for each affected or potentially exposed asset identified through the organisation’s decision-grade inventory and validation process rather than through assumptions derived from general platform availability, lack of alerts or absence of the specific files and logs that attackers may remove during exploitation and post-exploitation activity as described by the vendor and Huntress in their technical evidence available at the time of publication of this Security.io edition for enterprise security leadership and operational teams acting on the morning’s highest-priority decision before routine work displaces the evidence-preserving response required by the facts and remaining uncertainty documented in the cited sources and assessed in the sections below for accountable assignment, escalation and closure across affected business services and technical ownership boundaries today and during the next review cycle established by the CISO and incident commander for monitoring further vendor updates, research findings and authoritative guidance relevant to this active exploitation event and the emergency response actions necessary to reduce exposure, identify compromise and maintain essential services while the organisation completes the required patching, investigation, validation and governance work with clear evidence retained for later review by internal audit, customers, regulators, insurers or law enforcement where applicable based on the outcome of the compromise assessment and any additional impacts established through forensic analysis after containment of all internet-reachable PaperCut servers and verification that Release 3 or approved isolation is consistently implemented across the full enterprise estate including subsidiaries, acquired environments, educational campuses, remote sites, managed print providers, hosting partners and disaster-recovery systems that may not be visible through a single central management platform or asset database and therefore require coordinated outreach and technical validation by accountable owners before leadership can accept residual risk or declare the response complete under the evidence-based closure standard described in this edition and mapped to the protected Security.io intelligence taxonomy for long-term tracking of exploitation, remediation decisions and enterprise control effectiveness as further developments emerge from PaperCut, CISA or independent research teams following the cutoff used for this publication and its ranked assessment of the morning agenda for CISOs and their delegated operational leaders across vulnerability management, incident response, infrastructure, network security and business service ownership functions responsible for PaperCut deployment and ongoing support in the organisation today and beyond the immediate emergency window while any unresolved compromise indicators, unsupported versions or public exposure conditions remain open and require documented treatment by the named decision owner with escalation to executive leadership where containment, patching or investigation cannot be completed within the required horizon because of business dependency, technical limitation, unavailable expertise, change risk or third-party control boundaries that prevent timely evidence collection and remediation of the affected server environment under the currently published vendor instructions and confirmed exploitation status established by CISA and the direct observations from Huntress cited in this record for operational use and later review. For PaperCut MF on Windows, the advisory listed Release 3 build 76531 for version 26 with SHA-256 9375a9c3cf84140a1d8e21b72d3d2c57d85d4de09ea9ae1dc021b64732427da7, and build 76532 for version 25 with SHA-256 ba81e871ca20d688dd26fc950abaa49fb5ccb71a6dce3be97736256f644c0633.
Why this matters now
The affected application server is an administrative system that may be internet-accessible and runs attacker-supplied code within the PaperCut server process when the chain succeeds. That placement gives the issue materially greater consequence than an ordinary application defect. Enterprises, schools and service providers may also have decentralised print infrastructure that is poorly represented in vulnerability scanners or central asset inventories.
Release 3 resets the remediation baseline. A server recorded as patched during the weekend may still require another emergency change, while broken SAML or external-card-lookup functionality may have encouraged administrators to delay or reverse earlier fixes. The decision is therefore not simply whether a patch was deployed, but whether the correct release is present and whether temporary operational exceptions created renewed exposure.
Compromise assessment cannot depend on a clean filesystem or the absence of vendor network indicators. The observed code attempted to delete output files and server.log, and the cited sources published no validated malicious IP addresses, domains or URLs. Endpoint process lineage, file metadata, retained logs and surrounding network telemetry are consequently necessary to reach defensible closure.
The decision for security leaders
Assign a single accountable owner to reconcile asset inventory, network exposure, installed emergency release and compromise status. Separate those four questions in reporting: an isolated server may remain unpatched, a patched server may have been compromised earlier, and a clean vulnerability scan does not prove that Release 3 was installed correctly or that attacker activity was absent.
Require forensic preservation before routine upgrades on any server that was internet-accessible or shows a published artefact. Emergency change speed remains necessary, but responders should capture the PaperCut logs directory, file metadata, current configuration, process trees and surrounding network telemetry before restarts or installation procedures alter the evidence needed for investigation.
Treat version 23 or earlier as an executive exception rather than an ordinary backlog item. The owner must choose upgrade, effective isolation or service replacement; document the business dependency and expiry date; and establish monitoring capable of identifying application-server child processes or configuration changes until the unsupported instance is removed.
Evidence of closure
- CMDB export shows every PaperCut NG/MF server, accountable owner, installed version and internet-exposure state.
- Change record verifies Release 3 installation or approved isolation on every identified server.
- Forensic package preserves server logs, file metadata, process telemetry and network evidence for the exposure window.
- Hunt results document disposition of pc-app.exe child processes, five-character class files and published log strings.
The Security.io assessment
This is a high-confidence active-exploitation event supported by CISA, the vendor and direct customer-environment observations. Release 3 materially changes the morning decision because previous emergency releases are no longer the current remediation baseline. Organisations that completed weekend patching must reopen verification rather than relying on change-ticket status or a vulnerability-management scan generated before the new release.
The observed exploitation was limited to discovery in the Huntress cases, but that does not define the maximum impact or exclude different activity elsewhere. The exploit provides code execution in a privileged application process, and attackers attempted evidence cleanup. The absence of secondary malware in two observed environments should therefore constrain claims, not reduce investigation requirements for other exposed servers.
No validated malicious IP addresses, domains or URLs were published in the cited sources. Attribution posture: PaperCut and the cited researchers have not named an actor responsible for the exploitation. Until broader telemetry is published, local process, filesystem and log evidence remains more decision-useful than perimeter blocklists, and each exposed server requires an explicit disposition supported by retained evidence.
Questions for the morning meeting
- Can management identify every PaperCut NG/MF Application Server and its exposure state today?
- Were any internet-facing servers patched with Release 1 or Release 2 but not Release 3?
- Who can authoritatively separate patch completion from compromise status?
- Can responders preserve PaperCut and surrounding telemetry before upgrades or restarts alter evidence?