PaperCut Software vulnerabilities (CVE-2026-81578, CVE-2026-82078): #
PaperCut Software published a security bulletin on August 27, 2026, revealing that certain versions of PaperCut NG and PaperCut MF are affected by two vulnerabilities:
- CVE-2026-81578: An improper access control vulnerability in the web management interface allows requests targeting administrative functions to trigger backend actions before access validation completes. Successful exploitation allows a remote, unauthenticated attacker to modify certain system configurations. The vulnerability has been designated CVE-2026-81578 and has been rated high with a CVSS score of 8.8.
- CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist. Successful exploitation allows a remote, high-privileged attacker to modify system configurations. The vulnerability has been designated CVE-2026-82078 and has been rated critical with a CVSS score of 9.4.
PaperCut Software has confirmed that these vulnerabilities are being actively exploited in the wild.
Revision History:
- Update (August 31, 2026): There is evidence that both CVE-2026-81578 and CVE-2026-82078 are being actively exploited in the wild, prompting their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
- Update (August 28, 2026): PaperCut Software updated its security advisory to clarify that site servers and secondary/print servers must be patched alongside primary application servers. The vendor also issued Emergency Patch Release 2, which provides additional hardening and expands fix coverage to version 24.x.
- Initial Advisory (August 27, 2026): Initial disclosure of undisclosed vulnerabilities with active exploitation in the wild reported.
The following versions are affected
- PaperCut NG & MF: All versions prior to Emergency Patch Release 2
What are PaperCut NG and PaperCut MF? #
PaperCut Software PaperCut NG and PaperCut MF are server-based software applications that track, manage, and secure network printing, with PaperCut MF additionally integrating directly into multifunction printer hardware to control copying, scanning, and faxing.
What is the impact? #
Successful exploitation of these vulnerabilities would allow a remote attacker to modify critical application configurations and potentially achieve full compromise of the underlying PaperCut server.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- PaperCut NG & MF 26.x: Upgrade to version 26.x Emergency Patch Release 2 or later.
- PaperCut NG & MF 25.x: Upgrade to version 25.x Emergency Patch Release 2 or later.
- PaperCut NG & MF 24.x: Upgrade to version 24.x Emergency Patch Release 2 or later.
- Older / Unsupported Versions: Upgrade to a supported major version (26.x or 25.x) and apply the corresponding Emergency Patch Release 2.
If any PaperCut server is exposed to the public Internet, immediately restrict access to trusted IP addresses using firewalls or network access controls.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:="PaperCut Software" AND (product:="PaperCut MF" OR product:="PaperCut NG") AND source:runzeroApril 2023 advisory: #
PaperCut revealed that two products in its popular line of print server software contained severe vulnerabilities that were being exploited in the wild. Reported via the Trend Micro Zero Day Initiative, these vulnerabilities could be exploited by unauthenticated attackers to achieve remote code execution as the SYSTEM user (CVE-2023-27350/ZDI-CAN-18987) or information disclosure, including user information and password hashes (CVE-2023-27351/ZDI-CAN-19226).
With a CVSS score of 9.8 (“critical”), CVE-2023-27350/ZDI-CAN-18987 existed in the SetupCompleted class and could be leveraged for unauthenticated remote code execution due to improper access control. The Application Server and Site Server components of PaperCut MF and NG product versions 8.0 and later contained this flaw.
CVE-2023-27351/ZDI-CAN-19226 was assigned a CVSS score of 8.2 (“high”) and existed in the SecurityRequestFilter class as a flaw in the authentication algorithm, allowing for unauthenticated information disclosure. The Application Server component of PaperCut MF and NG product versions 15.0 and later contained this flaw.
PaperCut’s website claimed over 130 million users of their products across almost 90,000 organizations in almost 200 countries, including government, commercial, and educational users. Coupled with the substantial list of affected product versions and exploitation of these vulnerabilities already observed happening in the wild, the impact could have been quite broad. Trend Micro deferred disclosing more details on these vulnerabilities until the following month in order to give PaperCut customers time to patch.
While a definitive indicator of compromise didn’t exist in detecting exploitation of these vulnerabilities on a target, PaperCut did offer some clues one could look for.
The previous month, PaperCut had released patched versions 20.1.7, 21.2.11, and 22.0.9 which fixed these vulnerabilities. Older unsupported/end-of-life versions were not going to receive a patched update.
For admins who could not patch immediately, PaperCut provided a mitigation for CVE-2023-27351/ZDI-CAN-19226, but none was available at the time for CVE-2023-27350/ZDI-CAN-18987.
From the Services inventory, you can use the following prebuilt query to locate all PaperCut MF and NG servers in your network:
_asset.protocol:http and protocol:http and (http.body:"PaperCut MF is a print management system" OR last.http.body:"PaperCut MF is a print management system" OR http.body:"PaperCut NG is a print management system" OR last.http.body:"PaperCut NG is a print management system")
As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.
