Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Malicious actors are exploiting two newly patched security flaws in PaperCut NG and MF to execute arbitrary code, as the company released a fresh emergency fix with additional hardening.
Intelligence analysis by Qwen 2.5 (3B)
Attackers are chaining together two vulnerabilities to bypass authentication and gain remote code execution on affected PaperCut instances.
Bad guys found two ways to trick a security system. They used one way to get in, and then used the other way to do bad things. The company that makes the system fixed one of the ways, but the bad guys found another way to trick it. Now they can do more bad things.
Analysis
CVE-2026-81578: Improper Access Control Vulnerability
Huntress researchers identified an improper access control vulnerability in the web management interface of PaperCut MF and NG. This vulnerability allows unauthenticated remote requests to trigger backend actions prior to access validation checks, enabling attackers to bypass authentication and execute arbitrary code. The vulnerability has a CVSS score of 8.8.
CVE-2026-82078: Unsafe Dynamic Class Loading Vulnerability
The second vulnerability, CVE-2026-82078, is an unsafe dynamic class loading vulnerability in PaperCut's database connection utilities. Attackers can exploit this flaw by making changes to the server configuration, which can lead to code execution. The vulnerability has a CVSS score of 9.4.
Chaining Together the Flaws
Attackers are chaining together both vulnerabilities to bypass authentication and gain remote code execution. They use CVE-2026-81578 to bypass authentication and then use CVE-2026-82078 to execute arbitrary code. This chaining is possible due to the vulnerabilities' interplay and the lack of proper access control.
Impact and Mitigation
The Australian company, PaperCut, has released a second emergency patch that includes additional hardening beyond the original emergency patch. Organizations with vulnerable instances are advised to remove public exposure and apply the patch as soon as possible. Restricting web access to trusted IP addresses or placing the application behind a controlled administrative path is also recommended.
WatchTowr's Findings
WatchTowr discovered multiple patch bypasses and an additional authentication bypass vulnerability. One of the patch bypasses has been remediated in the second emergency patch, but new bypasses affecting the latest, fully patched version have been identified. The attackers are using a Java .class file to execute commands and gather information about the compromised environment.
Key points
- Attackers are chaining together two vulnerabilities to bypass authentication and execute arbitrary code.
- CVE-2026-81578 allows attackers to bypass authentication and execute arbitrary code.
- CVE-2026-82078 is an unsafe dynamic class loading vulnerability that can lead to code execution.
- Organizations should remove public internet access and apply the patch as soon as possible.
- WatchTowr discovered multiple patch bypasses and additional vulnerabilities.
Organizations can improve their security by removing public internet access and monitoring for signs of compromise, such as errors in log files.
If the vulnerabilities are not patched, attackers could continue to exploit them to gain unauthorized access and execute malicious code.
