PaperCut Vulnerability: What to Do About CVE-2026-82078

Update PaperCut NG or MF to Emergency Patch Release 2 now: two flaws are being chained for unauthenticated remote code execution on the print server, and they are being exploited in the wild. That is the PaperCut vulnerability behind this week’s headlines. If you run the software in a school, clinic, or office, today’s job is a version check, that specific patch, and a look at whether the admin interface answers from the internet. This note is the plain-English version of those three steps, written for the person who just saw the news and needs to know what to do.

Both flaws, CVE-2026-81578 and CVE-2026-82078, were added to CISA’s Known Exploited Vulnerabilities catalog on August 31, 2026. PaperCut disclosed confirmed customer incidents on August 27. The press write-ups from BleepingComputer, The Hacker News, and Rapid7 all land on the same action: apply Release 2, not the first emergency patch.

What’s actually broken

There are two bugs. They matter more together than they do apart.

CVE-2026-81578 is a missing-authentication flaw, scored 8.8. In plain English, parts of the PaperCut web management interface can be talked into changing system settings before they finish checking whether the caller is logged in. An unauthenticated remote attacker can modify configuration. That is the unlocked door.

CVE-2026-82078 is unsafe dynamic class-loading (unsafe reflection), scored 9.4. Once someone can change those settings, they can point PaperCut’s database-connection code at a driver that runs Java bytecode as the PaperCut server process. That is the ability to run code once you are through the door.

Chained, that is pre-auth remote code execution on the PaperCut Application Server: no login, no user clicking anything. Rapid7 walked the chain in technical detail. You do not need that level of detail to act. You need to know the door and the payload are both real, that they work as a pair, and that attackers are using the pair.

PaperCut has been a ransomware target before. In 2023 a different flaw, CVE-2023-27350, was widely exploited, including by ransomware groups. Rapid7 flags that history as a reason to treat this round with urgency. CISA currently lists ransomware use of these two new CVEs as unknown. Exploitation is confirmed. Customer incidents are confirmed. Who is behind this wave is still being sorted out.

Who this PaperCut vulnerability affects

Anyone running PaperCut NG or PaperCut MF. Emergency Patch Release 2 covers versions 24, 25, and 26 on Windows, Linux, and macOS. PaperCut currently treats all versions as potentially impacted. If you are on version 23 or older, there is no emergency patch for that line; the path is an upgrade to a current, patched release.

PaperCut is print-management software. Schools, clinics, government offices, and mid-size businesses use it to control printers and track jobs. The print server is not supposed to be a crown jewel. It usually sits on the same network as file shares, directory, and the rest of the office, so code execution on it is a foothold into that network. That is the part worth taking seriously.

A small shop with one printer on a USB cable often does not run this product. A clinic, a school district, or a multi-site office often does. If you are not sure, whoever manages your servers can answer in a minute: look at the About page in the PaperCut admin console, or at the installed program folder. Attackers scanning for PaperCut do not filter by metro. They filter by whether the software answers.

What to do today

Four steps. Whoever already runs this for you can do them. We are an independent second opinion, not a replacement for that person.

1. Confirm the version. You want to know two things: NG or MF, and whether you are on 24, 25, 26, or something older. The admin About page is the usual place. Write the number down. You will need it for step 2.

2. Apply Emergency Patch Release 2 specifically. PaperCut shipped a first emergency patch for versions 25 and 26 early on August 28. Researchers then found ways around it. Later the same day PaperCut shipped Release 2, with extra hardening and coverage for version 24. BleepingComputer and Rapid7 both stress this: if you applied the first emergency patch, you still need Release 2. Downloads and install steps live in PaperCut’s urgent security advisory. Update site servers and secondary print servers too. Print Deploy and Mobility Print are not affected.

3. If you cannot patch yet, get the admin and web interface off the public internet. Restrict those interfaces to trusted internal addresses, or put them behind a VPN. PaperCut’s first instruction is this restriction, even before the upgrade. A print server does not need a public address. Restrict an unpatched admin interface that answers from the public internet, and close that path while you wait for a change window.

4. If it was internet-reachable, look back before you overwrite evidence. PaperCut has published signs of tampering: the PaperCut process (pc-app.exe on Windows) launching command shells, missing or truncated server.log files, database errors mentioning jdbc:no:x or card-ID lookups, unexpected files under the server lib folder, or a new remote-access tool such as AnyDesk. Finding any of that changes the job from “apply a patch” to “preserve backups and follow incident procedures.” PaperCut’s own guidance for a confirmed compromise is to wipe and rebuild the Application Server from a clean backup taken before the suspicious activity.

If you are on version 23 or older, skip the wait for a backport. Upgrade to a current line that has Release 2, and keep the web interface internal until that upgrade is done.

How you’d know if you were exposed

An external penetration test is the independent version of the checks above. From outside your network, a tester looks at what actually answers on the internet: VPN, mail, firewalls, remote access, and, when it is there, a print-management admin interface. Those things are supposed to exist. The question is whether they are patched, configured, and reachable only by the people who should reach them.

A vulnerable PaperCut Application Server with its web interface on the public internet is exactly the kind of thing that test is built to catch. So is “we patched last week” that turns out to be the first emergency build, not Release 2. The finding is unpatched, reachable software. Running print management is ordinary.

That is a periodic check. It is also how you answer an insurer or a board that asks whether anything like this is sitting on your perimeter. External testing at azpentest starts at $4,000, retest included; the published tiers are on pricing. Between annual tests, news like this is why some teams also keep a continuous watch on the software they themselves ship, which is what Blindsight is for. Blindsight watches your code and its libraries. It does not watch a vendor print server. Today’s job is still the PaperCut box in front of you.

Frequently asked questions

Is PaperCut being on the internet a security problem?

No. Print-management software is supposed to exist. Reaching it from the office or over a VPN is normal. The issue is an unpatched version an unauthenticated attacker can reach. Apply Emergency Patch Release 2, and if the admin interface is on the public internet, restrict it to trusted addresses.

I already patched last week. Am I safe?

Only if that install was Emergency Patch Release 2. PaperCut shipped a first emergency patch for versions 25 and 26 early on August 28. Researchers then found ways around it, and Release 2 went out later the same day, adding version 24. Confirm you are on Release 2, not the first emergency build.

We’re a small Arizona business. Would attackers really bother?

They do not have to pick you by name. This kind of flaw is scanned for at internet scale: automated tools look for PaperCut servers and try the chain. Schools, clinics, and small offices get hit because they run the software, not because someone targeted them. Patch anyway.

How do I find out if our PaperCut server is exposed?

Confirm you run PaperCut NG or MF, read the version on the admin About page, and ask whether that web interface answers from outside the office. If you are not on Emergency Patch Release 2 and the interface is reachable from the internet, patch it. An external penetration test is the independent version of that same check.

Patch this PaperCut vulnerability, then decide what you want to know next

The PaperCut vulnerability in CVE-2026-82078 and CVE-2026-81578 is being exploited. The work for today is Release 2 (or an upgrade off version 23), the admin interface off the public internet if it is on it, and a look back if it was reachable. For the source material, start with PaperCut’s advisory, the CISA KEV catalog, Rapid7, BleepingComputer, and The Hacker News.

Not sure whether you are on the right build, or whether that interface answers from outside? Tell us what you run and we will take a look, then come back with a fair, fixed quote if an external test is the right next step. Request a quote.