Organizations that run PaperCut print management servers had a rough end to the week. On Thursday the vendor warned that attackers were exploiting a previously unknown flaw and rushed out an emergency patch. On Friday it released a second one, because security researchers had already found several ways around the first.
PaperCut NG and its sibling PaperCut MF track and control printing in offices, schools and universities, and MF also runs on the touchscreens of large office copiers. Both depend on a central Application Server with a web interface for administrators. That interface is where the trouble lies, and servers that expose it to the internet are the ones at immediate risk.
Two bugs that work as a pair
PaperCut initially held back the technical details to give customers time to patch. With the second release it has named two vulnerabilities. CVE-2026-81578, rated 8.8, is an access control failure in the web management interface: under certain conditions, a request from someone who has not logged in can set off administrative actions before the server has finished checking whether the request is allowed. In practice that lets an outsider change system configuration.
CVE-2026-82078, rated 9.4, sits in the code that connects PaperCut to its database. The software loads a database driver class by name, the name comes from configuration, and nothing checks it against a list of approved drivers. An attacker who can alter the configuration can therefore make the server load and run Java code of their choosing.
Put together, the first bug provides the configuration change and the second turns it into code execution, all without a valid account. PaperCut says it reproduced the attack with the help of a university customer whose own security and forensics teams had investigated an intrusion.
Why the first patch was not enough
The original emergency fix covered versions 25 and 26. Researchers at Huntress and watchTowr, who were working with PaperCut on the incident, then reproduced the whole chain, found multiple ways to get past the new protections and identified an additional authentication bypass. Release 2 adds hardening to deal with those findings.
PaperCut's instruction is unambiguous: install Release 2 even if the first emergency patch is already in place. It is offered for Windows, Linux and macOS and covers versions 24, 25 and 26. Anyone still on version 23 or older is told to upgrade to a current version instead of waiting for a fix. Site Servers and secondary print servers need the update as well. The Print Deploy and Mobility Print components do not.
Patching does not replace the other piece of advice, which is to stop the server's web interfaces from being reachable from untrusted addresses at all, using firewall rules or network access controls.
Checking for a break in
Huntress says it has seen exploitation in two customer environments so far. In both, the commands the intruders ran were simple reconnaissance, the kind that reveals which user account a process runs under and which operating system version is installed. That suggests the attackers were still finding their bearings, though it says nothing about what they did elsewhere.
PaperCut lists several things administrators should look for:
- Alerts from endpoint, intrusion detection or network monitoring tools that involve the Application Server process.
- A
server.logfile that is missing, has been deleted or is unexpectedly short. - The error
No suitable driver found for jdbc:no:xin that log. - The error
Database error looking up cardID: VALUES CASTin that log.
The company cautions that a server with none of these signs may still have been compromised. It has not said who is behind the attacks.
The pattern is a familiar one for this product. In 2023 a different pair of flaws in it was picked up within weeks by ransomware affiliates and state backed groups, with the education sector a particular target. Print servers tend to be forgotten until something like this happens, and they often sit on networks with access to far more than printers.
