PaperCut Issues Back-to-Back Emergency Patches for Actively Exploited Zero-Days

PaperCut published an urgent advisory on August 27, 2026 confirming active exploitation with customer incidents. Two zero-day vulnerabilities in its NG and MF products — CVE-2026-81578 and CVE-2026-82078 — forced the vendor into an unprecedented incident response: a first emergency patch on August 28, quickly bypassed, and a second released within the same 24 hours. The episode highlights the risks of a pre-authentication RCE chain in document-management software exposed to the internet.

The Technical Chain: From Error Page to System Shell

Rapid7's technical analysis reconstructs the full attack chain. The entry point is PaperCut's Apache Tapestry framework, where the service=direct parameter allows invocation of internal components by specifying a display page. The attacker selects public pages such as Error, Exception, or Home — which require no authentication — to mask the invocation of administrative components like ConfigEditor or UserList.

Once privileged component access is obtained, the attacker reconfigures external user-lookup settings by inserting a malicious JDBC connection string and an arbitrary SQL statement. The chain proceeds through Derby → H2 → Nashorn JavaScript triggers, culminating in arbitrary code execution on the underlying operating system. Documented attack URIs include /app?service=direct/1/Error/ConfigEditor/quickFindForm and similar variants.

"Any organization that has applied the original first version of the emergency patch is not protected, and must apply the second emergency patch immediately"

The Double Patch: When Incident Response Creates False Security

The timeline is the core of the problem. PaperCut released the first emergency patch on August 28, 2026 at 02:10 AEST for versions 25 and 26. Attackers quickly found an alternate path: using the Home page as the display page instead of Error or Exception kept the authentication bypass functional. The vendor was forced into a second release the same day.

The discrepancy in CVSS scores for CVE-2026-82078 — 9.8 from Cyber Daily, 9.4 from Rapid7 — reflects uncertainty in impact-metric assessment, not ambiguity about the flaw's severity. Both sources classify the vulnerability as Critical. CVE-2026-81578, rated CVSS 8.8, is defined as High but represents the indispensable prerequisite for the entire chain.

The situation exemplifies a dangerous pattern: organizations that promptly applied the first patch — correct behavior per best practice — found themselves in a state of false security while exploitation continued.

Indicators of Compromise: The Overlooked "VALUES CAST" Log Artifact

PaperCut and Rapid7 identified preliminary IOCs that require no sophisticated tools to detect. These include suspicious pc-app.exe process activity, missing or truncated server.log files, and specific error messages in the format Database error looking up cardID: VALUES CAST and No suitable driver found for jdbc:no:x.

The presence of these errors in PaperCut logs is significant because they fall outside the software's normal operational profile. The VALUES CAST artifact emerges directly from the SQL injection phase in the Derby→H2→Nashorn chain, making it a reliable compromise signal for log analysts. The fact that such explicit indicators are documented suggests at least some of the exploitation was traceable during incident investigation.

Immediate Actions

• Apply the second emergency patch immediately for PaperCut NG/MF versions 24, 25, and 26: the first patch is inadequate.
• Remove PaperCut NG/MF servers from public internet exposure and restrict web access to trusted IP addresses, as the vendor recommends.
\li>Check logs for the documented errors, particularly the VALUES CAST and jdbc:no:x strings, even in the absence of overt suspicious activity.
• Verify integrity and presence of the server.log file: anomalous truncation or deletion is a preliminary compromise indicator.

Why the Education Sector Remains in the Crosshairs

PaperCut's appeal as a target is no accident. The software manages document workflows that often include sensitive information — academic records, medical documents, research materials — and provides a pivot into the internal network. The education sector is historically exposed: the previous CVE-2023-27350 vulnerability in PaperCut NG/MF was exploited by the Bl00dy ransomware group and added to the CISA KEV catalog.

As Jake Knott, head of threat intelligence at watchTowr, observes, "PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated." WatchTowr has reproduced the 2026 vulnerabilities and is assisting PaperCut with the response.

The combination of pre-authentication RCE, confirmed active exploitation, and the need for a double patch elevates this event above routine threshold. Organizations with exposed servers must assume the compromise window is open and that the first patch does not constitute sufficient mitigation.

Frequently Asked Questions

Does the August 28 first patch protect?

No. Multiple sources confirm the first patch is bypassable by selecting the Home page as the display vector. Only the second patch released the same day blocks the full chain.

Which versions require updating?

PaperCut considers all NG and MF versions potentially impacted. Emergency patches are available for versions 24, 25, and 26. The source does not specify details for earlier releases.

Do the log errors always indicate compromise?

The documented strings — VALUES CAST and jdbc:no:x — are specific artifacts of the known exploit chain. Their presence in PaperCut logs constitutes a reliable compromise indicator, though absence does not rule out attacks using untraced variants.

Sources

• https://www.cyberdaily.au/security/14117-alert-papercut-issues-emergency-patches-for-papercut-ng-and-papercut-mf-warns-active-exploitation-underway
• https://therecord.media/papercut-warns-of-hackers-using-printer-management-vulnerabilities
• https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
• https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
• https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
• https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/?mid=1&
• https://therecord.media/cisa-warns-of-bl00dy-ransomware-gang-using-papercut-vulnerability
• https://therecord.media/cisa-adds-printer-bug-and-chrome-zero-day-to-catalogue
• https://therecord.media/iranian-state-sponsored-hackers-exploiting-printer-vulnerability