PaperCut NG/MF print servers: login bypass and code-execution flaws CVE-2026-81578 and CVE-2026-82078 used in attacks
Two PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, let attackers run code without a password and are being used in attacks, including data theft. Update to 24.1.10, 25.0.13 or 26.0.5. Version 23 and older get no fix. Home users: nothing to do.
If your business or school runs PaperCut NG or MF, update every Application Server, Site Server and secondary server to 24.1.10, 25.0.13 or 26.0.5 (or newer), and upgrade off version 23 or older. Restrict the web interface to trusted addresses and ask your IT provider to check for signs of compromise. Home users: nothing to do.
What’s happening
PaperCut NG and MF is print management software used by businesses, schools and government. On 27 August 2026 PaperCut warned of two flaws that, chained together, let an attacker run code on the server without a valid password. CISA added both to its list of flaws used in attacks on 31 August. Huntress saw exploitation in two customer environments, first looking like reconnaissance, and Defused later reported attackers dumping database tables to steal data. No attacker or victim has been named. The first emergency patch was bypassed by researchers, so PaperCut released Emergency Patch Release 2 on 28 August and Release 3 by 1 September, advising customers to install the latest even if they already patched. CISA lists fixes in 24.1.10, 25.0.13 and 26.0.5. PaperCut's September bulletin confirms 26.0.5 and 25.0.13; I could not confirm 24.1.10 on PaperCut's own pages. Version 23 and earlier receive no security update. Print Deploy and Mobility Print are not affected, but Site Servers and secondary servers need patching too.
- What
- Flaw
- Affects
- PaperCut NG and MF print management software
- Affected
- PaperCut NG/MF before 24.1.10
PaperCut NG/MF 25.x before 25.0.13
PaperCut NG/MF 26.x before 26.0.5
PaperCut NG/MF 23 and earlier (no security update) - Fixed in
- 24.1.10
25.0.13
26.0.5 - Since
- 27 Aug 2026
- Closed
- 24 Sept 2026
Timeline
- New fixFixed
PaperCut's September security bulletin lists maintenance releases 26.0.5 and 25.0.13, which replace the emergency releases. That bulletin names different CVEs; the 24.1.10 release was not confirmed on PaperCut's own pages I could read.
- Wider attacksPartly fixed
PaperCut issued Emergency Patch Release 3. Security firm Defused reported attackers abusing the login bypass to dump database tables and steal data, with activity from late 29 August. No attacker or named victim has been published.
- CISA addedPartly fixed
CISA added both flaws to its list of vulnerabilities being used in attacks. Its entry lists fixes in 24.1.10, 25.0.13 and 26.0.5.
- Fix incompletePartly fixed
Researchers at watchTowr and Huntress found ways around the first emergency patch, and watchTowr found a further login bypass. PaperCut released Emergency Patch Release 2 for versions 24, 25 and 26, and told customers to install it even if they had applied the first. Huntress had seen attacks on two customer environments that looked like reconnaissance.
- Made publicPartly fixed
PaperCut published an urgent security bulletin for PaperCut NG and MF, its print management software. Two flaws, CVE-2026-81578 and CVE-2026-82078, can be chained to run code on the server without a login.
Sources
- URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)PaperCut · 27 Aug 2026
- PaperCut NG/MF Security Bulletin (24 Sep 2026)PaperCut · 24 Sept 2026
- PaperCut releases second emergency patch for exploited flawsBleepingComputer · 29 Aug 2026
- Recently patched PaperCut zero-days used in data theft attacksBleepingComputer · 1 Sept 2026
- PaperCut NG/MF: two exploited flaws and a bypassed fixIT-Connect · 31 Aug 2026