CVE-2026-81578: 
PaperCut NG 취약성 분석 및 완화

CVE-2026-81578 is an improper access control (authentication bypass) vulnerability in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation checks complete, allowing an unauthenticated attacker to modify system configurations. It was disclosed on August 27–28, 2026, and was being actively exploited as a zero-day at the time of disclosure. Affected versions include PaperCut MF/NG prior to 24.1.9, 25.0.x prior to 25.0.12, and 26.0.x prior to 26.0.4. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, CISA KEV, PaperCut Advisory).

The vulnerability is classified as CWE-305 (Authentication Bypass by Primary Weakness) / CWE-306 (Missing Authentication for Critical Function). The root cause lies in a race-condition-like flaw in the Apache Tapestry-based web framework used by PaperCut's management interface, where certain HTTP requests to administrative endpoints can trigger backend processing before the access control check completes — a "request confusion" pattern. This allows an unauthenticated attacker to submit configuration changes (e.g., modifying the external user lookup settings) that are processed server-side without authentication. CVE-2026-81578 is typically chained with CVE-2026-82078 (an unsafe dynamic class loading vulnerability) to achieve pre-authentication remote code execution: the auth bypass enables configuration manipulation, which then triggers the RCE primitive via H2/Derby database configuration on version 26.x, or by dropping and loading a malicious Java class via Derby on versions 24.x–25.x (Metasploit PR, Rapid7 ETR, watchTowr).

Successful exploitation of CVE-2026-81578 alone allows an unauthenticated remote attacker to modify critical system configurations on the PaperCut server. When chained with CVE-2026-82078, attackers achieve full pre-authentication remote code execution, gaining SYSTEM-level privileges on Windows or the papercut service account on Linux. Observed real-world impacts include credential theft (targeting schools and universities), deployment of Meterpreter and other remote access tools, and data exfiltration from print management databases. An AI-orchestrated campaign documented by GreyNoise compromised approximately 395–440 organizations across 48 countries, demonstrating the vulnerability's potential for large-scale, automated exploitation (CISA KEV, BleepingComputer, The Hacker News).

CVE-2026-81578 was exploited as a zero-day in the wild prior to public disclosure on August 27–28, 2026, and was added to CISA's Known Exploited Vulnerabilities catalog on August 31, 2026, with a federal remediation deadline of September 14, 2026 (CISA KEV). A fully functional Metasploit exploit module (papercut_ng_external_user_lookup_rce) was merged on September 3, 2026, supporting Java, Windows, and Linux payloads and bypassing the vendor's first emergency patch (Metasploit PR). A Python-based detection tool is also publicly available on GitHub. The EPSS score is approximately 1.62%, though real-world exploitation has been extensive. Meterpreter has been confirmed as a deployed payload, and a notable AI-orchestrated campaign using hundreds of autonomous agents was attributed to a threat actor (possibly Russian-linked per some reports) that compromised hundreds of organizations in a highly automated fashion (GreyNoise, Arctic Wolf).

1. Reconnaissance: Identify internet-facing PaperCut MF/NG instances (default port 9191) using Shodan, Censys, or similar tools. Fingerprint the version using the PaperCut web interface or HTTP response headers to confirm a vulnerable version (prior to 24.1.10, 25.0.13, or 26.0.5).

2. Authentication Bypass (CVE-2026-81578): Send a crafted unauthenticated HTTP POST request to an administrative configuration endpoint (e.g., the ConfigEditor or external user lookup configuration endpoint) in the PaperCut web management interface. Due to the Tapestry request confusion flaw, the backend processes the configuration change before the access validation check completes.

3. Configuration Manipulation: Use the auth bypass to modify the external user lookup configuration, pointing it to an attacker-controlled server or injecting a malicious Groovy script or class path reference into the lookup settings.

4. Remote Code Execution (CVE-2026-82078 chain): Trigger the external user lookup function. On version 26.x, this executes a Groovy bootstrap in-memory via the H2 database engine. On versions 24.x–25.x, a malicious Java class is dropped via Derby and loaded dynamically, executing arbitrary code.

5. Payload Delivery: The Metasploit module serves a malicious JAR file via an embedded HTTP server. The PaperCut server fetches and executes the payload, establishing a Meterpreter reverse shell as SYSTEM (Windows) or the papercut service account (Linux).

6. Post-Exploitation: Restore PaperCut configuration to defaults (to avoid detection), then proceed with credential harvesting, lateral movement, or data exfiltration from the print management database (Metasploit PR, Rapid7 ETR).

• Network: Unexpected inbound HTTP POST requests to PaperCut administrative endpoints (e.g., /app?service=page/ConfigEditor, external user lookup configuration paths) from unauthenticated sources; outbound connections from the PaperCut server to unknown external IPs on non-standard ports (reverse shell callbacks); HTTP requests to attacker-controlled servers fetching JAR files.
• Logs: PaperCut application logs showing configuration changes to external user lookup settings without corresponding authenticated admin sessions; access logs showing POST requests to admin endpoints from unauthenticated sessions; Java class loading events referencing unexpected paths or Derby/H2 database activity.
• File System: Unexpected .class or .jar files dropped in PaperCut installation directories (especially under Derby data directories on versions 24.x–25.x); new scripts or executables created by the PaperCut process; modified version.txt or configuration files.
• Process: Unusual child processes spawned by the PaperCut Java process (e.g., cmd.exe, powershell.exe, /bin/bash, curl, wget); Meterpreter or other RAT processes running under the PaperCut service account; unexpected network connections from the Java process.
• Behavioral: PaperCut external user lookup configuration changed to point to an unknown server; admin configuration changes with no corresponding authenticated admin session in audit logs (Arctic Wolf, SOC Prime, Huntress).

PaperCut released emergency patches and subsequently full maintenance releases. Organizations should upgrade to the following patched versions immediately: PaperCut MF/NG 24.1.10, 25.0.13, or 26.0.5 (or later). Note that the vendor's first emergency patch (versions 24.1.9, 25.0.12, 26.0.4) was bypassed by the Metasploit module and attackers in the wild; the second emergency patch and subsequent maintenance releases address this bypass. If immediate patching is not possible, restrict access to the PaperCut web management interface (port 9191) to trusted IP ranges only using firewall rules, and disable internet-facing exposure of the admin interface. CISA's BOD 26-04 mandates federal agencies remediate by September 14, 2026 (PaperCut Advisory, CISA KEV, Metasploit PR).

PaperCut issued an urgent security advisory on August 27, 2026, and subsequently released two emergency patches before shipping fully QA-tested maintenance releases, acknowledging that the first emergency patch was bypassed by researchers and attackers (PaperCut Advisory). Rapid7's ETR team published a detailed technical analysis and developed the Metasploit module, noting the vulnerability was already being exploited in the wild at disclosure (Rapid7 ETR). GreyNoise documented a novel AI-orchestrated exploitation campaign using hundreds of autonomous agents that compromised ~395 organizations across 48 countries, sparking significant industry discussion about the emerging threat of AI-powered cyberattacks (GreyNoise). Security researchers on Reddit, Mastodon, and LinkedIn widely shared technical breakdowns, with the r/blueteamsec community actively discussing detection strategies. Security Magazine published commentary from security leaders on the broader implications of the vulnerabilities (Security Magazine). The Hacker News, BleepingComputer, SecurityWeek, and Cybersecurity Dive provided extensive coverage, and CISA issued an alert on August 31, 2026, adding both CVEs to the KEV catalog (CISA Alert).