PaperCut issues second emergency patch as print server flaws are exploited in the wild
A fix that could be bypassed is a reminder that blocking one exploit path is not the same as removing the bug.
PaperCut has released a second emergency patch for its NG and MF print management software after researchers found multiple ways around its first fix for two vulnerabilities that are being exploited in the wild, BleepingComputer reported on 28 August. The update, called Emergency Patch Release 2, applies to versions 24, 25 and 26 of the software on Windows, Linux and macOS, and replaces the earlier emergency release.
The two flaws are tracked as CVE-2026-81578 and CVE-2026-82078. The first, rated 8.8 on the CVSS scale, is an authentication bypass in the web management interface: unauthenticated requests can trigger administrative back-end actions before the access check has completed. The second, rated 9.4, is an unsafe dynamic class-loading weakness in the software's database connection utilities that allows arbitrary Java bytecode to be executed. PaperCut's advisory states that together the issues let unauthenticated attackers bypass authentication and gain remote code execution on affected instances.
Security firms watchTowr and Huntress confirmed that the vulnerabilities are being used in real attacks. Huntress said it observed exploitation in two customer environments, where it documented reconnaissance commands and hex-encoded Java files that served as a bridge to remote code execution. The report also notes that PaperCut software has been targeted by ransomware operations in the past, naming Clop, LockBit and the Bl00dy gang.
Administrators running any affected version are advised to apply the second emergency patch. Because the initial fix could be bypassed, having applied the first patch alone does not close the issue, and the second release is the one PaperCut now directs customers to install.
Why it matters
Print servers sit on internal networks with broad reach and are rarely treated as high-risk assets, which makes them attractive to attackers who want a quiet foothold. The need for a second patch shows that a rushed fix can leave the underlying weakness in place. Vendors and defenders are increasingly judged on whether a repair removes a class of bug rather than blocks a single exploit path. Expect more scrutiny of patch quality, not just patch speed.
Print servers sit on internal networks with broad reach and are rarely treated as high-risk assets, which makes them attractive to attackers who want a quiet foothold.
Unauthenticated request to web console
Attacker reaches the PaperCut NG/MF management interface without valid credentials.
CVE-2026-81578: authentication bypass
CVSS 8.8. Administrative back-end actions run before the access check has completed.
CVE-2026-82078: unsafe class loading
CVSS 9.4. Database connection utilities load attacker-controlled Java bytecode.
Remote code execution
Huntress observed reconnaissance commands and hex-encoded Java files used as an RCE bridge in two environments.
Emergency Patch Release 2
Second fix for versions 24, 25 and 26 after researchers bypassed the first patch.
What you can learn from this
- Authentication bypass through ordering bugs. Web applications usually run a chain of filters before a request reaches its handler, with an authentication check somewhere in that chain. If any code path lets the handler act before the check completes, or if a route is registered outside the filter's scope, an unauthenticated request can perform privileged work. These bugs behave the way they do because the framework treats "checked" as a state that has to be reached rather than a property guaranteed by default. Defensive designs invert this: every handler denies access unless an explicit, already-verified identity is attached to the request.
- Dynamic class loading and why it is dangerous. Java can load a class by name at run time, which lets applications plug in database drivers or extensions without recompiling. When the class name or the location it is loaded from can be influenced by user input, an attacker can supply their own bytecode and the runtime will execute it with the application's privileges. The flaw exists because the language feature trusts the caller to have validated the input. Safe use restricts loading to an allow-list of known classes and never derives the name from a request.
- Why first patches get bypassed. A quick fix often blocks the specific request pattern a researcher demonstrated, for example by rejecting a particular URL or parameter. Attackers then look for an equivalent path: a different encoding, an alternate route, or a second function with the same weakness. The underlying bug is the missing check, so any fix that leaves the check missing elsewhere will fail again. A durable fix moves the validation to the point where the dangerous action happens, so every route inherits it.
- CVSS scores tell you severity, not urgency. The Common Vulnerability Scoring System rates how bad exploitation would be based on factors such as whether authentication is needed and what impact results, which is why unauthenticated remote code execution lands above 9. Whether you should patch today depends on a second question: is it being exploited, and is your instance reachable? Confirmed exploitation reported by two independent firms moves a flaw to the top of the queue regardless of its score. Combining a severity score with exploitation evidence is how modern prioritisation frameworks work.
- Reconnaissance is the detectable phase. After initial access, attackers typically run commands to learn what machine they landed on, which users exist and what else is on the network. These commands leave process and log traces that are unusual for a print server, which normally runs a small, predictable set of processes. Detection works here because the baseline is narrow, so deviation is obvious. Endpoint telemetry that flags a web service spawning a shell catches many intrusions at this stage.
We teach this
How to use this in practice
- Inventory every utility server you can reach. List the print, badge, backup, monitoring and file-transfer services on the networks you administer, with their software version and whether their web interface is reachable from the general network. Include the machine in your home office if that is all you manage. Done looks like a table with one row per service, a version column, and a yes/no column for "admin interface restricted to a management subnet".
- Verify a patch rather than assuming it. For any system you maintain, pick one recent advisory and confirm that the installed version actually matches the fixed version, using the application's own version string rather than a package manager's record of what it installed. For a product like PaperCut that means reading the version reported by the admin console after a restart. Done looks like a screenshot or note showing the fixed version number and the date you confirmed it.
- Write one detection rule for a web service spawning a shell. Using whatever endpoint tooling or logging you have (Sysmon on Windows, auditd on Linux), create a rule that alerts when a Java or web server process launches
cmd.exe,powershell.exe,shorbash. Test it by triggering the behaviour yourself on a test machine. Done looks like an alert firing on your own test and no false positives over the next few days of normal use. - Restrict an admin interface to a management network. Choose one internal web console and add a firewall rule or reverse-proxy allow-list so that only a management subnet or VPN range can reach its login page. Confirm from an ordinary workstation that the page is now unreachable. If the console must stay reachable more widely, put it behind a VPN or an authenticating reverse proxy so that a bypass in the application's own login is not the only barrier. Done looks like a connection timeout from the general network and a successful login from the management range.
Sources
- PaperCut releases second emergency patch for exploited flaws — BleepingComputer
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report