Attackers Chain Two Paper Cut Flaws to Execute Code Without Authentication

Summary: Attackers are chaining two PaperCut NG and MF flaws, CVE-2026-81578 for authentication bypass and CVE-2026-82078 for remote code execution, to run arbitrary Java code on unpatched instances, and PaperCut has issued a second emergency patch for v24, v25, and v26 with additional hardening. Huntress observed limited exploitation on two customer environments, where attackers ran Base64-encoded commands including "whoami & ver" and deployed an OS-agnostic Java .class file that wrote output to "Udydn.out" before deleting it along with server.log and derby.log, and CISA added both flaws to its KEV catalog with a September 14, 2026 patch deadline for FCEB agencies.
Bottom line: watchTowr found new patch bypasses affecting the latest, fully patched version, so applying the patch does not close the question of whether an internet-facing PaperCut server was already reached - and its advice is to treat recently exposed systems as compromised and start incident response.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-81578 CVE-2026-82078
Related: Paper Cut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions Cyber Risks ·
Attackers Exploit Paper Cut Flaws to Steal Credentials From Schools and Universities Cyber Risks ·
Paper Cut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cyber Risks ·