{"id":"papercut-ng-mf-auth-bypass-rce-aug-2026","category":"patch","status":"closed","title":"PaperCut NG/MF print servers: login bypass and code-execution flaws CVE-2026-81578 and CVE-2026-82078 used in attacks","tldr":"Two PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, let attackers run code without a password and are being used in attacks, including data theft. Update to 24.1.10, 25.0.13 or 26.0.5. Version 23 and older get no fix. Home users: nothing to do.","summary":"PaperCut NG and MF is print management software used by businesses, schools and government. On 27 August 2026 PaperCut warned of two flaws that, chained together, let an attacker run code on the server without a valid password. CISA added both to its list of flaws used in attacks on 31 August. Huntress saw exploitation in two customer environments, first looking like reconnaissance, and Defused later reported attackers dumping database tables to steal data. No attacker or victim has been named. The first emergency patch was bypassed by researchers, so PaperCut released Emergency Patch Release 2 on 28 August and Release 3 by 1 September, advising customers to install the latest even if they already patched. CISA lists fixes in 24.1.10, 25.0.13 and 26.0.5. PaperCut's September bulletin confirms 26.0.5 and 25.0.13; I could not confirm 24.1.10 on PaperCut's own pages. Version 23 and earlier receive no security update. Print Deploy and Mobility Print are not affected, but Site Servers and secondary servers need patching too.","action":"If your business or school runs PaperCut NG or MF, update every Application Server, Site Server and secondary server to 24.1.10, 25.0.13 or 26.0.5 (or newer), and upgrade off version 23 or older. Restrict the web interface to trusted addresses and ask your IT provider to check for signs of compromise. Home users: nothing to do.","product":"PaperCut NG and MF print management software","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-81578","CVE-2026-82078"],"tags":["papercut","print-management","authentication-bypass","remote-code-execution","exploited","cisa-kev","data-theft"],"affected":["PaperCut NG/MF before 24.1.10","PaperCut NG/MF 25.x before 25.0.13","PaperCut NG/MF 26.x before 26.0.5","PaperCut NG/MF 23 and earlier (no security update)"],"fixed":["24.1.10","25.0.13","26.0.5"],"matches":[],"sources":[{"kind":"advisory","title":"URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","by":"PaperCut","date":"2026-08-27"},{"kind":"advisory","title":"PaperCut NG/MF Security Bulletin (24 Sep 2026)","url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","by":"PaperCut","date":"2026-09-24"},{"kind":"news","title":"PaperCut releases second emergency patch for exploited flaws","url":"https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/","by":"BleepingComputer","date":"2026-08-29"},{"kind":"news","title":"Recently patched PaperCut zero-days used in data theft attacks","url":"https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/","by":"BleepingComputer","date":"2026-09-01"},{"kind":"news","title":"PaperCut NG/MF: two exploited flaws and a bypassed fix","url":"https://www.it-connect.tech/papercut-ng-mf-two-exploited-flaws-and-a-bypassed-fix/","by":"IT-Connect","date":"2026-08-31"}],"started":"2026-08-27","closed":"2026-09-24","created":"2026-11-03T22:10:27.410Z","updated":"2026-11-03T22:10:27.410Z","cve_notes":[{"cve":"CVE-2026-81578","name":"Login bypass in PaperCut NG/MF web interface","what":"A missing-authentication flaw in PaperCut's web management interface lets administrative functions run before access checks finish, so an attacker with no login can change server settings and chain it with CVE-2026-82078.","severity":"critical","cvss":8.8},{"cve":"CVE-2026-82078","name":"Unsafe class loading in PaperCut NG/MF database tools","what":"An unsafe-reflection flaw in PaperCut's database connection utilities lets an attacker who can change configuration load and run their own Java code on the server, which with CVE-2026-81578 needs no login.","severity":"critical","cvss":9.4}],"timeline":[{"at":"2026-09-24","added":"2026-11-03T22:05:25.250Z","kind":"new-fix","text":"PaperCut's September security bulletin lists maintenance releases 26.0.5 and 25.0.13, which replace the emergency releases. That bulletin names different CVEs; the 24.1.10 release was not confirmed on PaperCut's own pages I could read.","url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","by":"PaperCut","patch":"patched"},{"at":"2026-09-01","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"PaperCut issued Emergency Patch Release 3. Security firm Defused reported attackers abusing the login bypass to dump database tables and steal data, with activity from late 29 August. No attacker or named victim has been published.","url":"https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/","by":"BleepingComputer","patch":"partial"},{"at":"2026-08-31","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added both flaws to its list of vulnerabilities being used in attacks. Its entry lists fixes in 24.1.10, 25.0.13 and 26.0.5.","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4","by":"CISA","patch":"partial"},{"at":"2026-08-28","added":"2026-11-03T22:05:25.250Z","kind":"fix-incomplete","text":"Researchers at watchTowr and Huntress found ways around the first emergency patch, and watchTowr found a further login bypass. PaperCut released Emergency Patch Release 2 for versions 24, 25 and 26, and told customers to install it even if they had applied the first. Huntress had seen attacks on two customer environments that looked like reconnaissance.","url":"https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/","by":"BleepingComputer","patch":"partial"},{"at":"2026-08-27","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"PaperCut published an urgent security bulletin for PaperCut NG and MF, its print management software. Two flaws, CVE-2026-81578 and CVE-2026-82078, can be chained to run code on the server without a login.","url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","by":"PaperCut","patch":"partial"}],"url":"https://hard.fyi/live/papercut-ng-mf-auth-bypass-rce-aug-2026/","json":"https://hard.fyi/api/live?id=papercut-ng-mf-auth-bypass-rce-aug-2026"}