CVE-2026-82078 / CVE-2026-81578 — PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed
PaperCut has been hit before at this scale: in 2023, CVE-2023-27350 — an unrelated authentication-bypass flaw in the same PaperCut NG/MF Application Server — was mass-exploited in the wild by multiple ransomware operators before a patch existed, a precedent Rapid7's own incident-response team cites directly when framing why this new chain demands the same urgency (Rapid7, 2026-08-28). Three years later, PaperCut disclosed on 27 August 2026 that it was investigating active exploitation of a new, unrelated flaw in the same product line — again before any CVE, patch, or public technical detail existed, and again reconstructed from a real victim's own incident-response evidence: a university customer's security and DFIR team supplied the reproduction data that let PaperCut confirm and patch the bug (PaperCut Software, 2026-08-29).
PaperCut's Application Server runs on the Apache Tapestry web framework, whose "complex direct" request format lets
a single HTTP request name one page to render and a different page's component to actually execute. PaperCut's own
authorization check validates only the page selected for rendering, not the component that runs behind it — so a
request that asks Tapestry to render the public, unauthenticated Error, Exception, or Home page while invoking the
administrative ConfigEditor or UserList component bypasses authentication entirely
(Rapid7, 2026-08-28).
Through three such POST requests — /app?service=direct/1/Error/ConfigEditor/quickFindForm,
.../ConfigEditor/$Form, and .../UserList/$QuickFind.$Form — an unauthenticated attacker rewrites four external
card/ID lookup settings (user-lookup.db-driver, user-lookup.db-url, user-lookup.id-to-username-sql,
user-lookup.enabled) that normally point PaperCut at an administrator-configured external card database
(Rapid7, 2026-08-28).
Redirected instead to an attacker-controlled JDBC target through PaperCut's bundled Apache Derby driver and its
foreignViews feature, the connection reaches an attacker-controlled H2 database whose inline INIT statement
creates a JavaScript-backed trigger; PaperCut's bundled Nashorn JavaScript engine then executes that trigger to
launch an operating-system process — full remote code execution as the PaperCut server, triggered the moment the
forged UserList search runs the malicious lookup
(Rapid7, 2026-08-28).
This is a two-CVE chain: CVE-2026-81578 (CWE-306, missing authentication) is the pre-auth entry that gains write
access to the server configuration; CVE-2026-82078 (CWE-470, unsafe dynamic class loading) is the flaw that turns a
reconfigured database connection into arbitrary Java bytecode execution once that write access is held
(PaperCut Software, 2026-08-29).
PaperCut treats all versions of NG and MF as potentially affected. Huntress observed two live customer
exploitations: one on 26 August lasting under two minutes against version 25.0.10.75465, and a second on 27 August
against version 24.1.5.71847 — before Emergency Patch Release 2 extended coverage to the v24 line
(Huntress, 2026-08-28). In both cases the attacker ran
base64-encoded discovery commands (whoami & ver, and separately whoami & ver & tasklist) via a dropped,
OS-agnostic Java .class file that wrote its output to a temporary file and then deleted both that file and the
server's own server.log
(Huntress, 2026-08-28). Huntress's own proof-of-concept
reproduced the full chain against a stock PaperCut NG install and observed the code execution surface as an
observable charmap.exe process running as SYSTEM, spawned under the PaperCut Application Server's own pc-app.exe
process
(Huntress, 2026-08-28). PaperCut released an initial
emergency patch for v25/v26 on 28 August, which a Home-page variant of the same request bypassed
(Rapid7, 2026-08-28).
Emergency Patch Release 2, published later the same day with hardening developed alongside Huntress and watchTowr,
closes that bypass and extends coverage to v24
(PaperCut Software, 2026-08-29).
There is no fix for v23 and earlier — PaperCut's guidance for that line is to upgrade to a supported version — and
Huntress estimates 47% of the roughly 2,500 PaperCut installations it tracks still run v23 or older
(Huntress, 2026-08-28).
Detection, telemetry class first: alert on any child process spawned from pc-app.exe or the PaperCut Application
Server's Java process — PaperCut never legitimately spawns a shell, cmd.exe, or a system-discovery utility such as
charmap.exe, whoami, or tasklist from that lineage. Web-access logs for the PaperCut Application Server should
be checked for POST requests to /app?service=direct/*/{Error,Exception,Home}/ConfigEditor/* or
.../UserList/$QuickFind.$Form from unauthenticated or external sources — this URL shape is not a pattern ordinary
PaperCut administration produces. Two log artifacts are near-unique indicators: a server.log line reading
DB URL: jdbc:derby:memory:pwn, and a corresponding derby.log entry recording Derby booting an in-memory database
directory whose name ends in the literal string pwn
(Huntress, 2026-08-28). Both PaperCut and Huntress
stress that these artifacts' absence does not clear a system, since the observed payloads delete their own
server.log evidence after running
(PaperCut Software, 2026-08-29).
Triage: an unexpectedly truncated, gapped, or missing server.log on a PaperCut Application Server is not
normal application behavior — legitimate log rotation does not delete mid-file — and is itself a high-confidence
signal worth investigating even where no other artifact survives.
PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.
PaperCut's authorization check could trust the rendered page and miss the permissions required by the component behind it.
By selecting either the public Error page or Exception page for display, an attacker can bypass authentication while invoking administrative components belonging to ConfigEditor or UserList.
47% of the approximately 2,500 PaperCut installations Huntress tracks are running v23 or older, for which no patch is currently available.
PaperCut has been targeted in the past; in 2023, CVE-2023-27350 was broadly exploited in the wild by multiple threat-actor groups, including ransomware operators.
Defender actions
- Apply PaperCut's Emergency Patch Release 2 to every PaperCut NG/MF Application Server now (v24/25/26); for v23 and earlier, immediately restrict the Application Server's web interface to trusted/internal IP addresses only — no patch exists for that line.
- Before patching or restarting an internet-facing server, preserve the server/logs directory and the Application Server's process tree; check server.log for the two vendor-documented error strings and for an unexplained gap or truncation, and check derby.log for a Derby boot line naming an in-memory database directory ending in "pwn" — either is a high-confidence sign of prior exploitation.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059.007Command and Scripting Interpreter: JavaScript
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
Stealth TA0005
T1070.004Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Discovery TA0007
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.