CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed

PaperCut has been hit before at this scale: in 2023, CVE-2023-27350, an unrelated authentication-bypass flaw in the same PaperCut NG/MF Application Server, was mass-exploited in the wild by multiple ransomware operators before a patch existed, a precedent Rapid7's own incident-response team cites directly when framing why this new chain demands the same urgency (Rapid7, 2026-08-28). Three years later, PaperCut disclosed on 27 August 2026 that it was investigating active exploitation of a new, unrelated flaw in the same product line, again before any CVE, patch, or public technical detail existed, and again reconstructed from a real victim's own incident-response evidence: a university customer's security and DFIR team supplied the reproduction data that let PaperCut confirm and patch the bug (PaperCut Software, 2026-08-29).

PaperCut's Application Server runs on the Apache Tapestry web framework, whose "complex direct" request format lets a single HTTP request name one page to render and a different page's component to actually execute. PaperCut's own authorization check validates only the page selected for rendering, not the component that runs behind it, so a request that asks Tapestry to render the public, unauthenticated Error, Exception, or Home page while invoking the administrative ConfigEditor or UserList component bypasses authentication entirely (Rapid7, 2026-08-28). Through three such POST requests, /app?service=direct/1/Error/ConfigEditor/quickFindForm, .../ConfigEditor/$Form, and .../UserList/$QuickFind.$Form, an unauthenticated attacker rewrites four external card/ID lookup settings (user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql, user-lookup.enabled) that normally point PaperCut at an administrator-configured external card database (Rapid7, 2026-08-28). Redirected instead to an attacker-controlled JDBC target through PaperCut's bundled Apache Derby driver and its foreignViews feature, the connection reaches an attacker-controlled H2 database whose inline INIT statement creates a JavaScript-backed trigger; PaperCut's bundled Nashorn JavaScript engine then executes that trigger to launch an operating-system process, full remote code execution as the PaperCut server, triggered the moment the forged UserList search runs the malicious lookup (Rapid7, 2026-08-28). This is a two-CVE chain: CVE-2026-81578 (CWE-306, missing authentication) is the pre-auth entry that gains write access to the server configuration; CVE-2026-82078 (CWE-470, unsafe dynamic class loading) is the flaw that turns a reconfigured database connection into arbitrary Java bytecode execution once that write access is held (PaperCut Software, 2026-08-29).

PaperCut treats all versions of NG and MF as potentially affected. Huntress observed two live customer exploitations: one on 26 August lasting under two minutes against version 25.0.10.75465, and a second on 27 August against version 24.1.5.71847, before Emergency Patch Release 2 extended coverage to the v24 line (Huntress, 2026-08-28). In both cases the attacker ran base64-encoded discovery commands (whoami & ver, and separately whoami & ver & tasklist) via a dropped, OS-agnostic Java .class file that wrote its output to a temporary file and then deleted both that file and the server's own server.log (Huntress, 2026-08-28). Huntress's own proof-of-concept reproduced the full chain against a stock PaperCut NG install and observed the code execution surface as an observable charmap.exe process running as SYSTEM, spawned under the PaperCut Application Server's own pc-app.exe process (Huntress, 2026-08-28). PaperCut released an initial emergency patch for v25/v26 on 28 August, which a Home-page variant of the same request bypassed (Rapid7, 2026-08-28). Emergency Patch Release 2, published later the same day with hardening developed alongside Huntress and watchTowr, closed that bypass and extended coverage to v24, and was itself superseded on 1 September 2026 by Emergency Patch Release 3 (see Update below) (PaperCut Software, 2026-08-29). There is no fix for v23 and earlier (PaperCut's guidance for that line is to upgrade to a supported version) and Huntress estimates 47% of the roughly 2,500 PaperCut installations it tracks still run v23 or older (Huntress, 2026-08-28).

Detection, telemetry class first: alert on any child process spawned from pc-app.exe or the PaperCut Application Server's Java process, PaperCut never legitimately spawns a shell, cmd.exe, or a system-discovery utility such as charmap.exe, whoami, or tasklist from that lineage. Web-access logs for the PaperCut Application Server should be checked for POST requests to /app?service=direct/*/{Error,Exception,Home}/ConfigEditor/* or .../UserList/$QuickFind.$Form from unauthenticated or external sources; this URL shape is not a pattern ordinary PaperCut administration produces. Two log artifacts are near-unique indicators: a server.log line reading DB URL: jdbc:derby:memory:pwn, and a corresponding derby.log entry recording Derby booting an in-memory database directory whose name ends in the literal string pwn (Huntress, 2026-08-28). Both PaperCut and Huntress stress that these artifacts' absence does not clear a system, since the observed payloads delete their own server.log evidence after running (PaperCut Software, 2026-08-29). Triage: an unexpectedly truncated, gapped, or missing server.log on a PaperCut Application Server is not normal application behavior (legitimate log rotation does not delete mid-file) and is itself a high-confidence signal worth investigating even where no other artifact survives.