The latest PaperCut emergency patch arrives as a direct response to active exploitation of two critical flaws in the NG and MF suites. Researchers from watchTowr and Huntress demonstrated pre-authentication remote-code-execution (RCE) chains that bypassed the first emergency fix, forcing PaperCut to issue a second release within days. This development underscores why organizations must treat emergency patches as part of a broader defense strategy, not a silver bullet.

PaperCut emergency patch – technical details

Two vulnerabilities, now catalogued as CVE-2026-81578 and CVE-2026-82078, form the attack surface. CVE-2026-81578 is an authentication bypass in the web management interface (CVSS 8.8). Unauthenticated HTTP requests can reach backend functions before the server completes access validation. CVE-2026-82078 is an unsafe dynamic class-loading issue (CVSS 9.4) in the database connection utilities. The application loads driver classes based on configurable names without an allowlist, allowing an attacker who can modify configuration parameters to execute arbitrary Java bytecode under the server’s security context.

The typical exploit chain starts with the authentication bypass, granting the adversary a foothold to alter the driver name in configuration files. Once changed, the unsafe class-loader executes a malicious .class payload found in the server’s classpath, completing the RCE step. Huntress captured hex-encoded Java class files in server logs, confirming that attackers used the flaw to run commands such as directory listing, configuration file reads, and network interface probes.

Why the first emergency patch fell short

PaperCut’s initial emergency patch, released for versions 25 and 26, tightened request validation to close the authentication bypass. However, it left the underlying class-loading weakness untouched and did not harden the configuration validation path. Within 48 hours, watchTowr reproduced the exploit and bypassed the fix via an undocumented API endpoint. The vendor responded with a second emergency release (Release 2) that adds stricter driver-name validation, additional input sanitization, and recommendations for firewall-style network segmentation.

This rapid bypass illustrates a systemic issue: emergency patches are often rushed to address the most visible symptom while neglecting root-cause remediation. In the PaperCut case, the authentication bypass was patched, but the unsafe class-loader remained exploitable, providing a second attack vector.

Incentives, consequences, and risk landscape

Attackers target print-management solutions because they sit at the intersection of corporate networks and peripheral devices, often with privileged access to sensitive documents. Successful exploitation of PaperCut can lead to credential theft, lateral movement, and deployment of ransomware or data-exfiltration tools. For vendors, the incentive to release a quick fix is to protect brand reputation and avoid regulatory fallout. However, a hurried patch can create a false sense of security, encouraging organizations to delay deeper architectural reviews.

Consequences of an unpatched or partially patched deployment include:

  • Unauthorized execution of arbitrary code on print servers, potentially compromising the entire network segment.
  • Exposure of internal document metadata, violating data-protection regulations such as GDPR or CCPA.
  • Disruption of printing services, which can impact business continuity in environments that rely on high-volume print workflows.

Operational impact and immediate actions

Enterprises running PaperCut NG/MF on Windows, Linux, or macOS must apply Release 2 immediately, even if the first emergency fix is already installed. The vendor advises updating both Site Servers and secondary/print servers; components such as Print Deploy and Mobility Print are unaffected. Organizations still on version 23 or earlier should perform a full upgrade to the latest major release, as the underlying architecture was revised to eliminate the unsafe class-loading path.

Beyond patching, administrators should enforce network-level controls:

  • Restrict access to the web interface to trusted IP ranges via firewall rules or NAC.
  • Monitor the pc‑app.exe process for unexpected command-line arguments.
  • Watch for error messages like ERROR No suitable driver found for jdbc:no:x in server.log.
  • Deploy application-level firewalls to block unauthenticated calls to administrative endpoints.

Broader lessons for the security community

The PaperCut emergency patch episode reinforces the need for defense-in-depth:

  • Asset inventory – Maintain an accurate list of PaperCut versions across the organization.
  • Network segmentation – Isolate print-management servers from the corporate backbone to limit lateral movement.
  • Application firewalls – Filter traffic to the management console and block known exploit patterns.
  • Continuous monitoring – Use SIEM rules that flag the specific error strings and class-loader activity identified by researchers.

These steps reduce reliance on a single vendor fix and improve overall resilience against sophisticated threat actors capable of reverse-engineering patches.

What to watch next

  • Threat-actor attribution – No group has claimed responsibility yet; monitoring underground forums for code snippets related to the CVEs may reveal the attackers.
  • Ransomware escalation – While current logs show only reconnaissance, the ability to execute arbitrary code could be leveraged for ransomware deployment in later stages.
  • Supply-chain ripple effects – Managed print services that embed PaperCut should audit their deployments and issue advisories to customers.
  • Regulatory scrutiny – In jurisdictions with strict data-protection laws, failure to apply critical patches may be deemed negligent, prompting investigations.

For organizations tracking the broader impact of security incidents on emerging tech ecosystems, the Web3 ecosystem board provides a real-time view of how vulnerabilities can affect cross-industry platforms.

The Web3 ecosystem board

Related coverage

Explore more on this topic