Ethical Hacking News
A recent vulnerability in PaperCut servers has left 47% of installations exposed to remote code execution. According to a report by Huntress, a security firm, PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. This vulnerability starts with a simple authorization mistake in PaperCut, allowing an attacker to change the server's configuration without logging in. Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet.
PaperCut servers are vulnerable to remote code execution due to a pre-authentication remote code execution flaw (CVE-2026-81578) that can be exploited without logging in. The vulnerability starts with a simple authorization mistake, allowing an attacker to change the server's configuration without logging in. A second flaw (CVE-2026-82078) can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server. Attacks can lead to code execution at the highest Windows privilege level, and reconnaissance attempts can be an early sign of a more serious attack. About 47% of PaperCut installations (version 23 or earlier) are still vulnerable, with no patch available. Organizations should remove the PaperCut Application Server from the public internet and restrict access through a VPN or internal network until a proper fix becomes available.
The cybersecurity landscape is under threat once again, as a recently discovered vulnerability in PaperCut servers has left 47% of installations exposed to remote code execution. According to a report by Huntress, a security firm that tracked the exploitation of the vulnerability, PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution.
PaperCut, a popular print management software used in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.
The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page. PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server's configuration without logging in.
That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut's database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.
The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.
The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse. The forensic trail attackers left behind is genuinely useful for defenders, and it's worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut's own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server's own log file to cover its tracks.
One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut's own investigation guidance now flags as a high-confidence indicator of compromise.
"After exploitation, the .class file deletes its own Udydn.out file, as well as the server's server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob's appearance in the log," continues the report. "We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb."
PaperCut's patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.
The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available. Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut's pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available.
If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation. Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory.
Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack.
Related Information:
https://www.ethicalhackingnews.com/articles/Hacking-Alert-PaperCut-Servers-Vulnerable-to-Remote-Code-Execution-47-of-Installations-Still-Unpatched-ehn.shtml
https://securityaffairs.com/198107/uncategorized/hackers-are-probing-papercut-servers-and-47-still-have-no-patch.html
https://nvd.nist.gov/vuln/detail/CVE-2026-81578
https://www.cvedetails.com/cve/CVE-2026-81578/
https://nvd.nist.gov/vuln/detail/CVE-2026-82078
https://www.cvedetails.com/cve/CVE-2026-82078/
Published: Sun Aug 30 08:43:51 2026 by llama3.2 3B Q4_K_M
