PaperCut ships second emergency patch after researchers break the first fix within days
Two chained flaws in the print-management software allow unauthenticated remote code execution. Attackers were already exploiting one of them before the first patch landed.
Printer-management software rarely makes headlines, which is part of why this one is worth paying attention to. PaperCut, whose NG and MF products sit behind print queues in universities, hospitals and corporate offices worldwide, shipped an emergency patch, watched researchers find a way around it within days, and then shipped a second emergency patch.
The more severe of the two flaws, CVE-2026-82078, rated 9.4, is an unsafe dynamic class-loading bug in PaperCut's database connection utilities. The application loads database driver classes based on configurable driver names without checking them against any approved allowlist. An attacker who can manipulate system configuration parameters can use that gap to execute arbitrary Java bytecode already sitting on the application's classpath, running under the same security context as the PaperCut server process itself.
The second, CVE-2026-81578, rated 8.8, is an authentication bypass in the PaperCut NG/MF web management interface. Under specific conditions, unauthenticated remote requests aimed at administrative functions can trigger backend actions before the software finishes checking whether the requester was allowed to make them in the first place.
Printer-management software rarely makes headlines, which is part of why this one is worth paying attention to.
Chained together, the two flaws add up to unauthenticated remote code execution, and attackers were reportedly already exploiting them before the first round of patches shipped. All versions of PaperCut NG and MF prior to August 27 are affected. PaperCut worked with researchers at watchTowr and Huntress after the initial patch turned out to have gaps, and published Emergency Patch Release 2 on August 28, covering NG/MF versions 24, 25 and 26 across Windows, Linux and macOS.
A patch that gets broken within 24 to 48 hours of release is not a rare event in this industry, but it is a useful data point on how fast serious researchers now turn a public advisory into a working bypass. Organizations running PaperCut have essentially no reason left to wait: version 26, the newest release line, is the one getting the fastest attention from both attackers and defenders right now.
PaperCut has been down this road before. A 2023 vulnerability in the same product line was picked up by ransomware affiliates within days of disclosure and used to breach managed service providers, giving attackers a foothold into every downstream client those MSPs served. That history is part of why watchTowr and Huntress moved as fast as they did this time around, and part of why the second emergency patch arrived within roughly 48 hours of the first one being shown not to hold. Print infrastructure is easy to overlook precisely because nobody thinks of a printer queue as a security boundary, until it turns out to be one.
Based on reporting by BleepingComputer.
