PaperCut NG/MF: Critical Authentication Bypass and RCE Chain CVE-2026-81578 & CVE-2026-82078

PaperCut NG and MF are subject to an active zero-day exploit chain combining an authentication bypass (CVE-2026-81578) and unsafe dynamic class loading (CVE-2026-82078). Attackers leverage the Apache Tapestry framework's 'complex direct' request format to mask administrative calls, bypassing access controls to modify external user-lookup database settings. By injecting malicious JDBC connection strings utilizing Apache Derby's 'foreignViews' and the H2 database's 'INIT' statement, attackers trigger the Nashorn JavaScript engine to achieve unauthenticated Remote Code Execution (RCE) via the pc-app.exe process. Immediate application of the second version of the emergency patch is mandatory to mitigate the risk of full system compromise.

• Vulnerability Overview: Critical Component Flaws

  • CVE-2026-81578 (CVSS 8.8): An authentication bypass allowing unauthenticated access to sensitive administrative components including ConfigEditor and UserList.
  • CVE-2026-82078 (CVSS 9.4): A critical unsafe dynamic class loading vulnerability enabling arbitrary code execution.
  • Outcome: The combination of these flaws allows a remote, unauthenticated attacker to gain full system-level access.

• Technical Exploit Chain: From Bypass to RCE

  • Initial Access: Attackers use specific URIs (e.g., /app?service=direct/1/Error/ConfigEditor/) to mask administrative calls behind public Error pages, bypassing Apache Tapestry's security checks.
  • Configuration Manipulation: Once bypass is achieved, attackers modify user-lookup settings, specifically the db-driver and db-url parameters.
  • Payload Delivery: Malicious JDBC strings trigger a chain involving Apache Derby's 'foreignViews' and H2's 'INIT' statements.
  • Final Execution: The chain invokes the Nashorn JavaScript engine to execute arbitrary system commands through the pc-app.exe process.

• Detection and Indicators of Compromise (IoCs)

  • URI Patterns: Monitor for requests targeting /app?service=direct/1/Error/ConfigEditor/ or /app?service=direct/1/Error/UserList/.
  • Log Analysis: Search for ERROR No suitable driver found for jdbc:no:x or Database error looking up cardID: VALUES CAST in system logs.
  • Process Monitoring: Alert on suspicious child processes spawned by pc-app.exe.
  • File Integrity: Check for unexpectedly truncated or missing server.log files, which may indicate attacker cleanup.

• Remediation and Urgent Mitigation

  • Immediate Patching: Update PaperCut NG/MF to the latest patched versions of v25 and v26.
  • Patch Versioning: Organizations must ensure the second version of the emergency patch is applied, as the first version was insufficient to block the exploit.
  • Forensic Review: Perform a retroactive search of logs for the specified JDBC error strings to determine if the environment was compromised prior to patching.

• Strategic Risk Assessment

  • Targeted Infrastructure: Print management servers typically hold elevated privileges and connectivity to Active Directory/LDAP, making them high-value targets for lateral movement.
  • Threat Actor Profile: PaperCut has a history of being targeted by ransomware operators, increasing the likelihood of this zero-day being used for large-scale deployments.
  • Emergency Priority: Due to active exploitation and the critical nature of RCE, this is classified as a security emergency for all CISOs.