Threat Intel PaperCut CISA KEV

PaperCut zero day chains an auth bypass into a Java class loader

September 2, 2026·8 min read·Chris Boker, Founder, CVEasy AI
A rust POST arrow from an attacker source box hits an open green padlock on a PaperCut web management panel, a gold arrow follows into a Config Editor row with a highlighted driver classname field, a mint arrow threads that field into a large geometric class loader hexagon whose central socket accepts a gold gadget token, a green PaperCut Application Server rack on the right emits a rust reverse arrow, and along the bottom two patch bands show the first cracked in half and the second sealed intact with a mint check mark

A district IT lead spent Thursday morning of August 27 rebuilding a PaperCut MF box after a student jammed a locker room MFP with an obscene banner sheet. By Thursday night she was reading a PaperCut security bulletin: an unauthenticated attacker on the LAN could reach the management interface she had just re-exposed for maintenance, rewrite a configuration value, and run Java code inside the print server. By Sunday morning she was patching again because the first emergency patch had been walked around. That is the shape of this event: a two flaw chain, a bypass, a second emergency release, and both CVEs now on CISA's KEV catalog with a September 14 federal deadline (Help Net Security, Rapid7).

How the chain actually runs

PaperCut disclosed CVE-2026-82078 (CVSS v4.0 9.4, Critical) and CVE-2026-81578 (CVSS v4.0 8.8, High) on August 27, 2026. The first is an unsafe dynamic class loading flaw inside PaperCut's database connection utilities. The second is an improper access control flaw (CWE-306, missing authentication for a critical function) in the web management interface. Neither is a novel primitive on its own; the chain is what turns them into pre-auth remote code execution against every reachable PaperCut Application Server in the world.

Start with CVE-2026-81578. The web management interface treats certain administrative components, notably ConfigEditor and UserList, as endpoints gated by a session check. Under specific request shapes the server dispatches the backend action before the access validation completes, so an unauthenticated POST reaches code paths designed to be admin only. Horizon3 documents the route: an attacker can bypass authentication while invoking ConfigEditor or UserList and, from there, edit a configuration file to trigger CVE-2026-82078 for Remote Code Execution.

Now CVE-2026-82078. PaperCut's database layer resolves the JDBC driver by reading a driver classname value out of its own configuration store, then handing that string to Class.forName style dynamic loading and instantiating whatever comes back. There is no allowlist. Any class on the application classpath is a valid target, and when the loaded class runs code inside a static initializer, constructor, or common JDBC bootstrap method, that code executes inside the PaperCut Java process (SOC Radar).

Wire the two together. One unauthenticated request through the ConfigEditor bypass writes a new driver classname pointing at a classpath gadget; a second request kicks the connection utility, the JDBC layer instantiates the "driver," and the gadget runs. No login, no session cookie, no user interaction, no memory corruption. The result is a Java process running attacker code under the print server's security context, and from that seat the attacker owns every card swipe, quota, LDAP bind, and stored PDF the fleet handles.

The first patch, and why the second was needed within a day

PaperCut published emergency patches the same day it disclosed the CVEs, covering the 24, 25, and 26 branches. Within hours Huntress and watchTowr had reproduced the exploit and bypassed the fix, and PaperCut shipped Emergency Patch Release 2 on August 28 with additional hardening (BleepingComputer). Fixed builds on the current release are 24.1.10, 25.0.13, and 26.0.5; the v23 branch and earlier must upgrade to a supported major first (Cybersecurity Dive, The Cyber Express). Attackers moved faster than the advisory: Huntress observed first exploitation attempts on August 26, and in two customer environments documented hands-on-keyboard discovery, the tell of a real iterating operator rather than an autoscan sweeping for a fresh CVE.

Two patch waves in two days. If your PaperCut change ticket landed on Wednesday's build, revalidate against 24.1.10, 25.0.13, or 26.0.5. Emergency Patch Release 2 is the version that actually closes the chain, and the first emergency build is public knowledge as a bypassable one.

Why a CVSS-first queue mis-ranks this

On CVSS alone CVE-2026-82078 is a 9.4 and CVE-2026-81578 is an 8.8, so a queue sorted by score buries the auth bypass under 9.6s and 9.9s from the same week and treats the two as independent items. Neither row on its own carries the real signal: the two chain, and unauthenticated intrusion was already running before the advisory published. The reachable software is the further tell. PaperCut's management port is the print operations back plane, and in many estates it is exposed to the campus LAN or, distressingly often, to the internet because a facilities vendor asked for remote support. A base score treats a print server like a print server; a defender who watched the last 48 hours knows this print server is currently an unauthenticated Java RCE fronted by a broken padlock.

How TRIS reads this finding

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, does not stop at the CVSS row. It ranks each finding through four layers that decide the actual priority against the actual asset.

Layer 1, exploitation status. Both CVEs sit on CISA KEV as of August 31 with a September 14 federal deadline, Huntress has confirmed hands-on-keyboard activity in customer environments, and PoCs from Horizon3 and watchTowr are circulating. TRIS pushes this layer to its top band.

Layer 2, reachability. The chain needs network reach to the Application Server web management port, typically 9191 HTTP and 9192 HTTPS. An instance reachable from the internet scores at the top band ACT (act now); the same build behind a segmented admin VLAN with a source ACL scores materially lower because the chain has nowhere to enter from.

Layer 3, process context blast radius. The Application Server runs as a service account holding AD credentials for LDAP bind, print job spool files, and secure release card material. If it federates against a production directory or holds badge secrets, this is a lateral move into identity, not a printer outage.

Layer 4, patch confidence. TRIS marks a fix as confidence eroded when a known bypass exists. The first emergency patch has a documented bypass, so a host that took only that build stays flagged until Emergency Patch Release 2 (24.1.10, 25.0.13, 26.0.5) is applied.

The same CVE pair sorts very differently across the estate. A PaperCut MF instance behind an admin ACL, on a segmented VLAN, with 26.0.5 applied and no LDAP bind is a routine Attend row. A PaperCut NG instance on an unpatched pre-fix build with port 9191 reachable from a student network and an LDAP bind against the primary domain is ACT, top priority, page the on call. TRIS keeps that honest: exploitation proven through a PoC is not the same signal as exploitation confirmed against your class of deployment.

What to do this week

Patch to Emergency Patch Release 2. Confirm the exact build strings 24.1.10, 25.0.13, or 26.0.5. If your Wednesday maintenance window applied the first emergency build, schedule the follow up now. Anything on v23 or earlier upgrades to a supported major first (CCB Belgium).

Restrict the management port until the patch is in. Apply a source ACL on the Application Server web management port (9191, 9192) allowing only admin jump hosts and the admin VLAN. This buys the hours between change control and green build; it is no substitute for the patch.

Hunt for the tell. Look for anomalous child processes of the PaperCut service account (JVM spawning shells, PowerShell, curl, wget), unexpected outbound connections from the PaperCut host, new files under the install directory that do not match a build manifest, and configuration changes to the database driver classname that no one on the team made. Huntress noted the initial hands-on activity was discovery flavored, so process listings, network enumeration, and directory walking are the early indicators.

Rotate what the box held. Treat as suspect any secrets accessible from a host that ran a vulnerable build with the management port reachable: LDAP bind accounts, secure print release tokens, and MFP scan-to-email or scan-to-share credentials the server pushed out.

The first emergency patch is bypassable. Only Emergency Patch Release 2 (24.1.10, 25.0.13, 26.0.5) closes the chain. If your CMDB shows any earlier emergency build than these, the host is still in the exposed set and needs the second patch before September 14.

How CVEasy AI surfaces this on your estate

CVEasy AI, the number one local-first Continuous Threat Exposure Management platform, ingests the primary sources for events like this (PaperCut bulletins, CISA KEV, Huntress and watchTowr research, and vendor advisories from Rapid7, Qualys, and Tenable) and runs them through TRIS against the actual inventory on your own hardware. The queue view answers the concrete questions directly: which PaperCut hosts are on a vulnerable build; which have the management port reachable from a network segment an attacker could reach; which are still on the first emergency patch and need the second; and what identity blast radius the JVM service account carries into the rest of your estate. Your inventory, build strings, and LDAP bind context stay on your hardware, and TRIS hands the on call team a prioritized ticket queue with the KEV clock, the bypass note, and the identity exposure attached to each row.

Sources: CISA KEV alert (August 31, 2026), Huntress, Horizon3, SOC Radar, BleepingComputer, The Hacker News, Help Net Security, Rapid7, Tenable, Cybersecurity Dive, The Cyber Express, CCB Belgium