CVE-2026-81578: 
PaperCut NG Analisi e mitigazione delle vulnerabilità

CVE-2026-81578 is an improper access control (authentication bypass) vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete, allowing an unauthenticated attacker to modify system configurations. The vulnerability was disclosed on August 27–28, 2026, and was being actively exploited as a zero-day at the time of disclosure. Affected versions include PaperCut MF/NG prior to 24.1.9, versions 25.0.2 through 25.0.11, and versions 26.0.2 through 26.0.3. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, CISA KEV).

The root cause is classified as CWE-305 (Authentication Bypass by Primary Weakness) / CWE-306 (Missing Authentication for Critical Function): the web management interface processes certain administrative requests and triggers backend actions before completing access validation, effectively allowing pre-authentication access to privileged operations. The vulnerability is exploitable remotely over the network with no privileges, no user interaction, and low attack complexity. When chained with CVE-2026-82078 (an unsafe dynamic class loading flaw), an unauthenticated attacker can achieve remote code execution — the exploit manipulates the external user lookup configuration to load a malicious Java class via H2/Derby database mechanisms (version-dependent), ultimately executing arbitrary code on the server (Metasploit PR, GitHub Advisory). Technical analysis describes the attack as a "Tapestry request confusion" that allows pre-authentication RCE when the two CVEs are chained together.

Successful exploitation allows an unauthenticated remote attacker to modify critical system configurations on PaperCut MF/NG print management servers. When chained with CVE-2026-82078, attackers achieve full remote code execution, gaining SYSTEM-level privileges on Windows or papercut service account access on Linux, enabling credential theft, data exfiltration, lateral movement, and potential ransomware deployment. Observed real-world attacks have targeted schools and universities in the U.S. and Europe, with attackers deploying remote access tools and stealing credentials from compromised print servers (CISA KEV, Metasploit PR).

CVE-2026-81578 was actively exploited as a zero-day at the time of disclosure and was added to CISA's Known Exploited Vulnerabilities catalog on August 31, 2026, with a remediation due date of September 14, 2026 (CISA KEV). A fully functional Metasploit exploit module (papercut_ng_external_user_lookup_rce) was merged on September 3, 2026, implementing end-to-end exploitation of the CVE-2026-81578 + CVE-2026-82078 chain with Java, Windows, and Linux payload support (Metasploit PR). A Python-based indicator detection tool is also publicly available on GitHub. The EPSS score is approximately 1.62% (74th percentile). PaperCut's initial emergency patch was bypassed by researchers, necessitating a second emergency patch. Attackers have been observed targeting educational institutions for credential theft and deploying remote access tools, with one threat actor toolkit (GRYXA) reportedly leveraging these flaws.

1. Reconnaissance: Identify internet-facing PaperCut MF/NG servers (default port 9191) using tools like Shodan or Censys, targeting versions prior to 24.1.9, 25.0.2–25.0.11, or 26.0.2–26.0.3.
2. Version fingerprinting: Send an unauthenticated HTTP request to the PaperCut web interface to enumerate the version string (e.g., via the login page or version endpoint), as the exploit path differs between v26.x (H2 database) and v24.x–25.x (Derby database).
3. Authentication bypass (CVE-2026-81578): Craft an HTTP request targeting an administrative function endpoint in the web management interface. Due to the Tapestry request confusion flaw, the backend processes the request and triggers the action before access validation completes, granting effective unauthenticated administrative access.
4. Configuration manipulation: Using the authentication bypass, modify the external user lookup configuration (e.g., set a malicious LDAP/script path) via the ConfigEditor interface to point to an attacker-controlled resource.
5. Dynamic class loading (CVE-2026-82078): Trigger the external user lookup function. On v26.x targets, this executes a Groovy bootstrap in-memory via H2; on v24.x–25.x, a malicious Java class is dropped via Derby and loaded.
6. Payload delivery: The Metasploit module hosts a malicious JAR file on an attacker-controlled HTTP server; the PaperCut server fetches and executes it, establishing a reverse shell (Meterpreter) as SYSTEM (Windows) or the papercut service account (Linux).
7. Post-exploitation: Reset the PaperCut configuration to defaults to reduce forensic artifacts, then proceed with credential harvesting, lateral movement, or ransomware deployment (Metasploit PR, GitHub Advisory).

• Network: Unusual unauthenticated HTTP POST requests to PaperCut administrative endpoints (port 9191) from external IP addresses; outbound connections from the PaperCut server to unknown external IPs (attacker-hosted HTTP server for JAR payload delivery); unexpected LDAP or script lookup requests to external hosts.
• Logs: PaperCut application logs showing administrative configuration changes (e.g., external user lookup settings modified) without a corresponding authenticated admin session; access logs with requests to ConfigEditor or user lookup endpoints from unauthenticated sources.
• File System: Unexpected .class or .jar files dropped in PaperCut installation directories (particularly in Derby database paths on v24.x–25.x); web shells or scripts in the PaperCut web root; CSV files created and deleted in rapid succession (Derby bootstrap artifact).
• Process: Unusual child processes spawned by the PaperCut Java process (e.g., cmd.exe, powershell.exe, bash, curl, wget); Meterpreter or other reverse shell processes running under the PaperCut service account or SYSTEM.
• Remote Access Tools: Presence of unauthorized remote access tools (RATs) installed on the PaperCut server host following exploitation (CISA KEV, Metasploit PR).

PaperCut has released patched versions: 24.1.9, 25.0.12, and 26.0.4 (and later). Organizations should upgrade immediately, as PaperCut's initial emergency patch was bypassed and a second emergency patch was required — only the second patch (v2) has been verified to successfully remediate the exploit chain (Metasploit PR, CISA KEV). If immediate patching is not possible, restrict network access to the PaperCut web management interface (port 9191) to trusted internal IP addresses only, and monitor for suspicious administrative function calls from unauthenticated sessions. CISA's BOD 26-04 mandates federal agencies apply mitigations by September 14, 2026 (CISA KEV).

PaperCut issued an urgent security advisory on August 27, 2026, acknowledging active exploitation and releasing emergency patches; a second emergency patch was subsequently required after researchers demonstrated the first fix could be bypassed (GitHub Advisory). Rapid7 published an ETR (Emerging Threat Response) blog post and developed the Metasploit module, with researcher Stephen Fewer (sfewer-r7) leading the exploit module development and noting the vendor's second patch successfully remediates the chain (Metasploit PR). Huntress, Qualys, eSentire, Horizon3.ai, Field Effect, and SOCRadar all published analyses and detection guidance. Security Week, BleepingComputer, The Hacker News, and Cybersecurity Dive provided extensive media coverage, with The Hacker News reporting on attackers specifically targeting schools and universities for credential theft. Community sentiment on Reddit and social media highlighted the severity of the patch bypass and the rapid weaponization via Metasploit.