PaperCut Software spent the final week of August 2026 doing something few vendors want to do twice in 48 hours: shipping an emergency patch, watching researchers break it, then shipping a second one. On August 27, the print-management company confirmed active, in-the-wild exploitation of a chained vulnerability affecting PaperCut NG and PaperCut MF, its widely deployed print and document-tracking platform used across schools, universities, government agencies, and corporate print fleets. Within roughly 36 hours, two CVEs were assigned, one emergency patch shipped, and then a second “Emergency Patch Release 2” followed after outside researchers demonstrated the first fix could be bypassed.
The episode has revived a familiar anxiety in enterprise IT: print servers, long treated as background infrastructure, keep turning into some of the most exploitable machines on the network. PaperCut has been here before. In 2023, a nearly identical vulnerability pair in the same product line was weaponized by ransomware affiliates linked to Cl0p and LockBit. Three years later, the vendor is racing through patch revisions again, while a federal vulnerability-tracking record and the company’s own advisory briefly told two different stories about whether attacks were even happening.
What Happened: PaperCut’s Urgent Security Advisory
PaperCut published an “URGENT Security Advisory” on August 27, 2026, telling customers it was investigating active exploitation of a vulnerability chain in PaperCut NG and PaperCut MF Application Servers, according to the company’s own security bulletin. The advisory confirmed customer incidents tied to the flaw, a step vendors rarely take unless compromises have already been verified rather than just theorized by researchers.
Incident response firm Huntress, which had been tracking exploitation attempts against PaperCut servers, published its own technical breakdown the same day. Huntress described the activity as targeting internet-exposed PaperCut Application Servers and said it worked directly with PaperCut and fellow research firm watchTowr on remediation, according to Huntress’s writeup. That kind of three-way collaboration between a vendor and two independent security firms during an active incident signals how seriously the exploitation was treated internally, even before public messaging caught up.
Anatomy of the Attack Chain: CVE-2026-81578 and CVE-2026-82078
The PaperCut zero-day is not one bug but two, chained together. CVE-2026-81578 is an authentication bypass rooted in missing authentication for a critical function, letting an attacker skip login entirely. CVE-2026-82078 is the more severe half of the pair, a pre-authentication remote code execution flaw caused by unsafe dynamic class loading, carrying a CVSS score of 9.4. CVE-2026-81578 scores 8.8. Chained together, an attacker with no credentials can reach a PaperCut Application Server over the network and execute arbitrary code on it.
That combination, an auth bypass paired with unsafe class loading, is a familiar shape in Java-based enterprise applications, and PaperCut’s server components run on Java. Attackers do not need to steal a password or trick a user into clicking anything. They need only network access to the exposed ports on a PaperCut Application Server, which is exactly the condition that made the 2023 PaperCut incidents so damaging. Plenty of organizations had left their Application Servers reachable from the open internet for remote-printing convenience, and the same exposure pattern is showing up again in 2026.
Timeline: From First Patch to a Second Emergency Release
The sequence of events compressed what would normally be a weeks-long patch cycle into about a day and a half.
The initial emergency patch
PaperCut shipped its first emergency builds for versions 25 and 26 on Windows on August 28 at 02:10 AEST, identified as NG build 25.0.12.76497 and MF build 25.0.12.76496. Version 24 fixes were still described as “in progress” at that point, and specific first-round build numbers for non-Windows platforms weren’t published alongside the Windows releases.
Emergency Patch Release 2
Hours later, PaperCut shipped what it called Emergency Patch Release 2, at roughly 2:45 p.m. Eastern on August 28. The company’s advisory explains the reason plainly: after working further with its internal security team and external researchers Huntress and watchTowr, PaperCut found the original emergency patch could be bypassed, and it released additional hardening beyond that first fix. Release 2 covers versions 24, 25, and 26 across Windows, Linux, and macOS, and PaperCut is telling every customer to apply it even if they already installed the first emergency build.
Version-level fix boundaries for Release 2 land at NG/MF 24.1.10, 25.0.13, and 26.0.5. Anything below those version numbers is treated by PaperCut and national cybersecurity agencies as still exposed to the chain.
Why the First Patch Failed
Patch bypasses happen more often than vendors like to admit, especially under the time pressure of an active-exploitation disclosure. A rushed fix tends to close the specific request pattern attackers were observed using rather than the underlying logic flaw, and skilled researchers can often find a slightly different request that reaches the same vulnerable code path. That appears to be what happened here. WatchTowr and Huntress found a bypass technique against the first emergency build quickly enough that PaperCut pulled together a second, more thorough fix within the same news cycle.
For IT teams, the practical lesson is uncomfortable but simple. Applying “a patch” for this incident does not mean the job is done. Only Emergency Patch Release 2 or later closes the chain. Anyone still running the original emergency build from earlier on August 28 remains exposed to the exact bypass researchers demonstrated.
The CISA Paradox: “Exploitation: None” vs. Active Attacks
One detail has drawn particular attention from security researchers this week. The federal government’s own automated exploitation-status record for CVE-2026-82078, using the Stakeholder-Specific Vulnerability Categorization (SSVC) framework, was timestamped August 28 at 15:35 UTC and listed exploitation status as “none,” according to reporting from SeverityDaily. That timestamp lands after PaperCut had already told customers it was dealing with confirmed incidents, and only hours before the company shipped Release 2.
The mismatch isn’t evidence of a cover-up so much as a case study in how automated vulnerability-scoring pipelines can lag behind a live incident. SSVC records are typically generated from structured data feeds and updated on their own cycle, not in real time as a vendor’s advisory language shifts. But the gap matters practically. Security teams that rely on automated feeds to triage “is this actively exploited” risk under-prioritizing a patch that its own vendor is calling urgent. It’s a reminder that vendor advisories and government tracking systems can tell two different stories, on the same day, about the same CVE.
Who’s Affected: Versions, Platforms, and the Legacy Problem
PaperCut and national cyber agencies, including Canada’s Cyber Centre, are treating all NG and MF versions prior to their respective Emergency Patch Release 2 builds as potentially affected. That’s a broad exposure window covering versions 24, 25, and 26 across every supported operating system.
The harder problem sits with version 23 and earlier. According to threat-intelligence tracking cited in coverage of the incident, there is no code fix planned for v23 or older, and an estimated 47% of PaperCut installs tracked by researchers are still running that branch or something older. Nearly half of the observed install base, in other words, cannot patch its way out of this one. Their only real option is an upgrade to a supported version followed immediately by Release 2, a heavier lift for schools and public-sector IT teams that tend to run print infrastructure on long replacement cycles.
| PaperCut Branch | Status Before Aug 28 | Patched / Fixed In | Platforms Covered |
|---|---|---|---|
| v26 (NG/MF) | Vulnerable to CVE-2026-81578 / -82078 | 26.0.5 (Emergency Patch Release 2) | Windows, Linux, macOS |
| v25 (NG/MF) | Vulnerable; first emergency build 25.0.12.76497/76496 (Windows) bypassable | 25.0.13 (Emergency Patch Release 2) | Windows, Linux, macOS |
| v24 (NG/MF) | Vulnerable; fix “in progress” as of first emergency release | 24.1.10 (Emergency Patch Release 2) | Windows, Linux, macOS |
| v23 and earlier | Vulnerable | No dedicated fix; upgrade to v24+ required | Not applicable |
History Repeats: PaperCut’s 2023 Cl0p and LockBit Nightmare
PaperCut NG/MF has a documented history with exactly this class of bug. In 2023, CVE-2023-27350, a pre-authentication remote code execution flaw, and CVE-2023-27351, an information-disclosure vulnerability, were exploited by ransomware affiliates linked to Cl0p and LockBit. Those campaigns targeted internet-exposed PaperCut Application Servers for initial access and lateral movement, a pattern documented at the time in the National Vulnerability Database and widely covered across the security industry.
No named ransomware group has been publicly tied to the August 2026 exploitation yet. PaperCut’s advisory confirms customer incidents without attributing them to a specific actor, and researchers covering the story have stopped short of connecting it to Cl0p, LockBit, or any other named operation. But the structural similarity, auth bypass chained with remote code execution against the same product family, is close enough that several security writeups explicitly framed the new chain against the backdrop of 2023’s exploitation history.
| Metric | 2023 Incident | 2026 Incident |
|---|---|---|
| CVE IDs | CVE-2023-27350, CVE-2023-27351 | CVE-2026-81578, CVE-2026-82078 |
| Vulnerability type | Pre-auth RCE + info disclosure | Auth bypass + pre-auth RCE (unsafe dynamic class loading) |
| Highest CVSS score reported | Widely reported as critical severity | 9.4 |
| Confirmed threat actors | Cl0p, LockBit-linked affiliates | Not publicly attributed as of this report |
| Patch attempts before resolution | Single patch cycle | Two emergency releases within roughly 36 hours |
Market Impact: Print Infrastructure as an Overlooked Attack Surface
Print management software rarely gets the security budget attention that firewalls, identity platforms, or endpoint detection tools receive, as SecurityWeek’s ongoing coverage of the incident has noted, yet it typically runs with elevated service account privileges and sits deep inside a network to talk to every printer on a floor. PaperCut in particular is entrenched in education and public-sector environments, where its print-quota and cost-tracking features made it a default choice for university IT departments managing thousands of student accounts. That footprint is precisely why ransomware operators targeted it in 2023, and it’s why a repeat vulnerability chain in the same product family carries outsized risk regardless of who ultimately exploits it.
For managed service providers and IT teams running PaperCut across school districts or municipal governments, this incident adds urgency to a broader industry conversation about “boring” infrastructure software. Firewalls and VPN appliances have dominated 2026’s zero-day headlines, but PaperCut’s second run-in with a critical, ransomware-adjacent flaw in three years suggests attackers are still finding value in scanning for exposed print servers that defenders deprioritize. Security teams that maintain asset inventories rarely rank print servers alongside domain controllers or email gateways, and that gap in attention is exactly what a chained, unauthenticated RCE is built to exploit.
How PaperCut’s Response Compares to Other Vendor Disclosures
Judged purely on speed, PaperCut’s response looks aggressive: a public advisory, an initial patch, and a hardened second patch, all inside roughly a day and a half. That cadence sits closer to how the largest software vendors handle an actively exploited zero-day mid-cycle than to the slower, multi-week disclosure timelines that have drawn criticism for some network-appliance vendors in past incidents. Shipping a second patch within hours of a bypass being demonstrated, rather than waiting for a scheduled release window, reflects the “patch now, refine later” posture that regulators and federal agencies have pushed vendors toward in recent years.
Where PaperCut’s response is weaker is legacy support. Several enterprise software vendors have faced sustained criticism for leaving vulnerable end-of-support versions in the field long after patches stop shipping for them, and PaperCut’s decision not to fix v23 and earlier follows that same playbook. With nearly half of tracked installs reportedly sitting on that unsupported branch, the practical security benefit of a fast, well-coordinated patch for v24 through v26 is capped by how many customers simply cannot receive it without a full upgrade project first.
Detecting Exposure: What Administrators Can Check Right Now
Before applying Emergency Patch Release 2, administrators need to know what version they’re running and whether the Application Server is reachable from outside the corporate network. A quick local version check on a Windows PaperCut Application Server can be run from PowerShell:
Get-ItemProperty "HKLM:SOFTWAREPaperCut Software*" |
Select-Object DisplayName, DisplayVersionAny version reported below 24.1.10, 25.0.13, or 26.0.5, or anything on the v23 branch or earlier, should be treated as vulnerable to the CVE-2026-81578/CVE-2026-82078 chain until Emergency Patch Release 2 is applied. Network teams should also confirm whether the PaperCut Application Server’s web interface and API ports are reachable from the public internet. If they are, PaperCut’s own guidance is to restrict access to trusted internal networks immediately, patch or not.
What IT Teams Should Do Now
- Apply Emergency Patch Release 2 immediately on every PaperCut NG/MF Application Server running v24, v25, or v26, even if the original emergency patch was already installed.
- Treat any internet-exposed PaperCut Application Server that hasn’t yet been patched as potentially compromised, not merely at risk, and consider an incident-response review rather than a simple in-place patch.
- Remove PaperCut Application Servers from direct public internet exposure and restrict access to VPN or trusted internal ranges.
- Plan an upgrade path for any server still running v23 or earlier, since no dedicated fix exists for that branch.
- Monitor vendor and national CERT advisories, including PaperCut’s own bulletin and agencies such as Canada’s Cyber Centre, for further hardening updates given the pattern of a bypassed first patch.
Historical Context: A Pattern Ransomware Groups Keep Exploiting
The PaperCut saga fits a broader pattern that has defined enterprise security since 2023: mid-tier infrastructure software, the kind that isn’t a household name but sits on thousands of servers, keeps becoming the entry point for the year’s biggest ransomware campaigns. MOVEit Transfer’s mass exploitation by Cl0p in 2023 followed the same logic. A widely deployed file-transfer tool with a critical, unauthenticated vulnerability turned into a supply-chain-scale breach. PaperCut’s own 2023 incident and this new 2026 chain both trace back to the same root cause: enterprise software vendors underestimating how attractive “boring” infrastructure becomes once a working exploit chain exists for it.
Predictions: Where This Goes From Here
- Expect CISA’s Known Exploited Vulnerabilities catalog to add both CVE-2026-81578 and CVE-2026-82078 in short order, once the agency’s tracking catches up with PaperCut’s own confirmation of active exploitation.
- A third patch or supplemental hardening advisory from PaperCut within the next one to two weeks is plausible, following the pattern of the first patch’s bypass. Vendors that ship twice under pressure often follow with a cleanup release once the immediate fire is out.
- Ransomware affiliates will likely begin mass-scanning the internet for unpatched, internet-exposed PaperCut Application Servers in the coming weeks, echoing the opportunistic scanning that followed the 2023 CVE-2023-27350 disclosure.
- Organizations still on PaperCut v23 or earlier will face growing pressure from cyber-insurance underwriters and compliance auditors to complete an upgrade, given the absence of a patch path for that branch.
- Expect renewed scrutiny of print-management and document-workflow software as a category, with security leaders folding these systems into vulnerability-management programs they previously treated as low priority.
Frequently Asked Questions
What is the PaperCut NG/MF zero-day vulnerability?
It’s a chained pair of flaws, CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (pre-authentication remote code execution via unsafe dynamic class loading), disclosed by PaperCut on August 27, 2026, and confirmed as actively exploited against internet-exposed Application Servers.
What are the CVSS scores for CVE-2026-81578 and CVE-2026-82078?
CVE-2026-82078 carries a CVSS score of 9.4. CVE-2026-81578, the authentication bypass used earlier in the chain, scores 8.8.
Is the PaperCut zero-day being actively exploited?
Yes. PaperCut’s August 27 advisory confirmed active, in-the-wild exploitation and customer incidents. A separate automated CISA tracking record briefly listed exploitation status as “none” on August 28, a discrepancy attributed to lag in automated vulnerability-scoring pipelines rather than a dispute over the facts.
Which PaperCut versions are affected by this vulnerability chain?
PaperCut NG and MF versions 24, 25, and 26 are affected prior to their respective Emergency Patch Release 2 builds (24.1.10, 25.0.13, and 26.0.5). Version 23 and earlier are also considered vulnerable, with no dedicated fix currently planned for that branch.
How do I patch against the PaperCut zero-day?
Apply Emergency Patch Release 2 to any PaperCut NG/MF Application Server on v24, v25, or v26, even if the original emergency patch from earlier on August 28 was already installed, since researchers demonstrated a bypass of that first fix. Servers on v23 or earlier need to be upgraded to a supported version before Release 2 can be applied.
Why did PaperCut need a second emergency patch?
External researchers from Huntress and watchTowr found a way to bypass the first emergency patch shortly after it shipped. PaperCut responded with Emergency Patch Release 2, described as adding hardening beyond the original fix, within hours of the bypass being demonstrated.
Has PaperCut been exploited by ransomware before?
Yes. In 2023, CVE-2023-27350 and CVE-2023-27351 in the same PaperCut NG/MF product line were exploited by affiliates linked to the Cl0p and LockBit ransomware operations, primarily against internet-exposed Application Servers.
Should I take my PaperCut server offline while I patch?
If your Application Server is reachable from the public internet and unpatched, restricting network access immediately is safer than leaving it exposed during the patch window. PaperCut’s own guidance urges customers to remove internet exposure and treat suspected compromise as an incident-response matter rather than something a patch alone resolves after the fact.