PaperCut NG/MF, Scan-to-Fax path traversal to OS command execution for an authenticated administrator (CVSS 4.0 7.3), fixed in 26.0.5 and 25.0.13; part of watchTowr's pre-auth chain against the 28 August emergency build

PaperCut's Emergency Patch Release 3, published 1 September 2026, supersedes Release 2 and is cumulative, customers do not need to install the earlier releases first (PaperCut Software, 2026-09-02). Release 3 fixes two regressions Release 2 had itself introduced, broken SAML login flows, and lost support for legacy Microsoft SQL Server drivers used for external card lookup, and adds further, undisclosed hardening against the exploitation chain (PaperCut Software, 2026-09-02). PaperCut also confirms a second wave of attacks against servers that remain unpatched and internet-facing, whose post-compromise behaviour "has been more sophisticated than in the first days of this incident" (PaperCut Software, 2026-09-02). The vendor's own incident data, published 30 August as additional indicators of compromise, names a concrete follow-on chain from the original intrusion: after initial discovery commands, a PowerShell-delivered download installs a Windows service literally named "Remote Access Service" running SimpleService.exe, a SimpleHelp remote-access agent, as LocalSystem with auto-start, followed by a further download of AnyDesk; the bulletin does not state whether this specific chain recurred in the second wave or belongs only to the earlier intrusions it was published alongside (PaperCut Software, 2026-09-02). Mobility Print and Print Deploy server components are unaffected; Site Servers and secondary/print servers do need the same update as the primary Application Server (PaperCut Software, 2026-09-02).

GreyNoise's Global Observation Grid documents an AI-agent-orchestrated exploitation campaign against this chain beginning 31 August 2026, run by a likely Russian-speaking operator already tracked since July 2026 for attacks on Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE targets (GreyNoise, 2026-09-09). The operator built and tested both CVEs' exploits in a self-hosted PaperCut/Active Directory lab, sourced target lists via the Netlas.io scanning service, then deployed hundreds of AI agents, built on OpenAI's Codex harness paired with a DeepSeek model, to opportunistically "compromise at least 440 instances of PaperCut MF/NG hosted by 395 identified victim organizations in 48 countries" (GreyNoise, 2026-09-09). GreyNoise reports the adversary "went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds" (GreyNoise, 2026-09-09), with one US high school reaching full domain admin in seven minutes from initial access. Domain admin was ultimately reached against only twelve of the 395 compromised organizations, "GreyNoise observed the adversary achieved domain admin against only 12 victim organizations" (GreyNoise, 2026-09-09), via three paths: LSASS credential harvesting for pass-the-hash against the domain controller when the PaperCut host was domain-joined; the 2021 noPac flaws (CVE-2021-42278/CVE-2021-42287) where those remained unpatched; or directly adding a new account to Domain Admins when the PaperCut host itself ran on the domain controller or under a domain-admin service account. All three paths finished with a DCSync-based full NTDS.DIT credential dump; Cloudflare's WAF defeated the adversary against at least one targeted instance. This delta is reported by GreyNoise alone; a second independent source had not corroborated it as of this update.

PaperCut published security maintenance releases 26.0.5, 25.0.13 and 24.1.10 for NG and MF on 10 September 2026. Unlike the emergency patches, they went through the vendor's full release testing, carry new version numbers and release notes, and address all the CVEs in the advisory with the same protection as the emergency patches plus additional hardening. PaperCut's instruction is plain: "These releases replace the emergency patches. If you are running an emergency patch build, move to a maintenance release. If you have not yet patched, upgrade now." A server already on Emergency Patch Release 3 is protected against both CVEs and can schedule the upgrade through normal change control, while one still on Release 1 or 2 should move now. Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server (PaperCut Software, 2026-09-10).

Nothing changes for v23 and earlier: there is no emergency patch or maintenance release for that line, and the only route to a fixed build is an upgrade to a supported line (24, 25 or 26), with web access to the Application Server restricted to trusted addresses until then. PaperCut also reports that new compromises have slowed considerably and that most customers now have the Application Server behind a firewall or on a patched build, but that publicly reachable, unpatched servers are still being targeted (PaperCut Software, 2026-09-10). For an estate that patched in the first week, the task is to move each server from its emergency build to the maintenance release and confirm the version on every Site Server and secondary server, not only on the primary. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-08-31 (CISA KEV).

watchTowr Labs published a write-up on 2026-10-09 that follows the emergency patches build by build (watchTowr, 2026-10-09). Its timeline: the patch released on 28 August (26.0.4-PO build 76508) fixed two bypasses watchTowr had reported; watchTowr then bypassed the fix for the authentication bypass again (tracked internally as WT-2026-0143, no CVE assigned) and found a new post-authentication code-execution flaw in Scan-to-Fax (WT-2026-0144, now CVE-2026-82077), which together gave a full unauthenticated chain against build 76508; the patch released on 1 September (build 76530) fixes WT-2026-0143, and 26.0.5, released on 10 September, fixes CVE-2026-82077 (watchTowr, 2026-10-09). The authentication bypass abuses the Setup Wizard forms, which the earlier patches had ignored: every stage can be reached through the Home page even after setup is complete, and watchTowr shows it modifies the administrator password (watchTowr, 2026-10-09). watchTowr also publishes a Detection Artefact Generator that tests a server's exposure to the authentication bypasses but does not run the full chain (watchTowr, 2026-10-09).

PaperCut's September security bulletin lists CVE-2026-82077 as a code-execution flaw in the Scan-to-Fax component that needs an authenticated administrator, rated CVSS 4.0 7.3, fixed in 26.0.5 and 25.0.13, and says servers already on the latest release are covered (PaperCut Software, 2026-09-24); it names no 24.x release and no emergency build. The unauthenticated chain watchTowr describes is closed by the 1 September patch, but an administrator-level foothold still reaches code execution through Scan-to-Fax until the maintenance release is installed. No source names exploitation of CVE-2026-82077 or of the Setup Wizard bypass. PaperCut says Emergency Patch Release 3 closes off additional attack vectors it has observed being exploited in the wild, without naming them (PaperCut Software, 2026-09-10).