PAPERCUT

PaperCut MF and PaperCut NG are widely deployed print-management platforms used by schools, universities, government agencies, healthcare systems, and enterprises to meter, bill, and control network printing. Because print servers are treated as low-priority infrastructure, they are routinely exposed to the internet for remote print release and mobile printing, rarely hardened, and infrequently patched — a profile that makes PaperCut's web-based administration console an unusually attractive target whenever a pre-authentication vulnerability surfaces in it. That has now happened twice, three years apart, via two structurally similar but technically distinct vulnerability chains.

The first generation — CVE-2023-27350 (CVSS 9.8) and CVE-2023-27351 (CVSS 8.2) — was disclosed in March 2023 and became one of the most consequential mass-exploitation events of that year: the FBI and CISA jointly attributed active exploitation to the Bl00dy Ransomware Gang against the U.S. Education Facilities Subsector, and Microsoft separately confirmed the Cl0p and LockBit ransomware ecosystems, the TrueBot-linked "Lace Tempest" cluster, and Iranian state-sponsored groups tracked as Mango Sandstorm (MuddyWater) and Mint Sandstorm all independently weaponized the same flaw within weeks of disclosure (CISA/FBI AA23-131A, 2023; Microsoft Threat Intelligence, 2023).

The second generation — CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4) — is not history; it is unfolding as this card is compiled, and it has continued to escalate since the previous compile. PaperCut published an urgent security bulletin on 2026-08-27 after Huntress confirmed exploitation in two customer environments, shipped an emergency patch the same day, and then shipped a second emergency patch just 24 hours later (2026-08-28, 2:45 PM ET) after independent researchers at watchTowr Labs reproduced the chain and found the first patch could still be bypassed. A third emergency patch followed on 2026-09-01, fixing two known regressions in Release 2 and adding further hardening. CISA added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog on 2026-08-31, and threat-intelligence firm Defused has observed exploit activity against the chain in its honeypots continuously since 2026-08-29. Post-exploitation activity has evolved beyond reconnaissance: threat intelligence now documents attackers covertly installing legitimate remote-access tools (SimpleHelp, AnyDesk) for persistent access on compromised servers, and a separate track of activity abusing the flaw for direct database-table exfiltration via PaperCut's Derby database rather than full remote code execution (Help Net Security, 2026-08-31; BleepingComputer, 2026-08-31). No threat actor has been publicly attributed to the 2026 activity as of this compile. As of the most recent count, roughly 47% of the ~2,500 PaperCut installations Huntress tracks are running version 23 or earlier — versions for which no patch exists at all, meaning nearly half of the visible install base has no remediation path short of a version upgrade — and Shadowserver independently tracks over 800 PaperCut MF/NG servers still directly exposed to the internet.

PaperCut matters right now because the two generations share the same underlying design pattern despite being technically unrelated bugs: an unauthenticated request against the web management interface that the server's authorization logic mis-trusts, chained into a privileged, code-execution-capable feature that the console exposes to authenticated admins by design (Print/Device Scripting in 2023; unsafe dynamic database-driver class loading in 2026). Any environment running PaperCut and reachable from the internet or an untrusted network segment should treat this as an active, not historical, risk — one now formally recognized by CISA's KEV catalog in both generations.

2023 generation (CVE-2023-27350). PaperCut's web console ships a first-run setup flow ending at the SetupCompleted page (/app?service=page/SetupComplete, implemented in pcng-server-web-19.2.7.jar). Security researcher Caleb Stewart, working independently to replicate the ZDI-reported flaw, found that visiting this page post-installation and submitting its form triggers a "Session Puzzling" condition: the application accidentally validates an anonymous session and internally calls performLogin() for the administrator account without verifying a password. The attacker is now an authenticated admin with zero credentials. From there, the built-in Device/Print Scripting feature — JavaScript hooks that PaperCut deliberately allows admins to attach to printer events, which execute under NT AUTHORITY\SYSTEM on Windows — becomes a code-execution primitive: modify a printer's script, and the next event fires attacker-controlled code with SYSTEM privileges (Horizon3.ai deep dive, 2023).

2023 generation (CVE-2023-27351). A related but distinct flaw in the SecurityRequestFilter class stems from an improperly implemented authentication check, allowing an unauthenticated network attacker to bypass authentication and pull sensitive account data — usernames, full names, email addresses, department/office fields, payment-card information, and hashed passwords for PaperCut-internal accounts — directly from the server (SentinelOne Vulnerability Database, 2023). This card treats it as CWE-287/CWE-303 (Improper Authentication / Incorrect Implementation of Authentication Algorithm) based on vendor and researcher language describing the flaw; this has not been independently cross-checked against NVD's authoritative CWE tag during this compile and should be verified before citing with high confidence.

2026 generation. The pattern recurs with different mechanics. CVE-2026-81578 is a request-routing "confused deputy": an attacker sends a crafted request that references one page for rendering while targeting a different page's backend component for execution. PaperCut's authorization check validates the page being rendered, not the privileged component actually being invoked — so a request can trigger an administrative configuration change while the authorization layer believes it is serving an unauthenticated, low-privilege page. That configuration-write capability is then chained into CVE-2026-82078, an unsafe dynamic class-loading flaw (CWE-470, Use of Externally-Controlled Input to Select Classes or Code) in PaperCut's database-connection utilities: the application instantiates a JDBC driver class using a driver-name string pulled from its own configuration, without validating that name against an allowlist. An attacker who can write to that configuration (via CVE-2026-81578) can point the "driver name" at an attacker-supplied Java class already reachable on the application's classpath — and the server loads and executes it (eSentire security advisory; Huntress, 2026).

The throughline across both generations: PaperCut's web console conflates "is this request permitted to reach this rendering path" with "is this request permitted to trigger this backend action," and separately treats internal configuration state (driver names, script bindings) as a trusted input channel for selecting executable code. Neither generation is a memory-safety bug or a novel exploitation primitive — both are authorization-boundary design defects in the same class of web-application architecture, which is precisely why the same vendor produced two unrelated instances of it three years apart.

2023 generation. Trend Micro's Zero Day Initiative (ZDI-23-233) responsibly reported the vulnerability to PaperCut on 2023-01-10. PaperCut shipped a fix on 2023-03-08 (versions 20.1.7, 21.2.11, 22.0.9), and the coordinated public advisory followed on 2023-03-14. PaperCut's own investigation later identified the earliest suspicious activity possibly tied to CVE-2023-27350 as far back as 2023-04-14 — roughly five weeks after the patch shipped but well before most administrators had applied it. PaperCut publicly confirmed active exploitation on 2023-04-19. A working proof-of-concept was published publicly on GitHub around 2023-04-25, and mass exploitation — most visibly the Bl00dy Ransomware Gang's campaign against the U.S. Education Facilities Subsector — followed within days. CISA added CVE-2023-27350 to the KEV catalog on 2023-04-21, ahead of the PoC's public release, reflecting how quickly the exploitation signal outran the initial vendor advisory.

2026 generation. This chain's public timeline is compressed to days rather than months. Huntress observed the first confirmed exploitation of CVE-2026-81578/CVE-2026-82078 in a customer environment on 2026-08-26. PaperCut published an urgent security bulletin and shipped an initial emergency patch on 2026-08-27 — the same day Huntress detected a second intrusion, this one against a server running version 24 before that branch's fix was available. Independent researchers at watchTowr Labs then fully reproduced the chain and identified multiple ways to bypass the initial patch, plus an additional authentication-bypass angle the first patch generation had not addressed. PaperCut responded with Emergency Patch Release 2 on 2026-08-28 at 2:45 PM ET — roughly 24 hours after the first patch — explicitly instructing customers to install Release 2 even if Release 1 was already applied. Threat-intelligence firm Defused reported continuous exploit activity against the chain in its honeypots from 2026-08-29 onward, and by 2026-08-31 independent reporting documented two distinct post-exploitation patterns: covert installation of legitimate remote-access tools (SimpleHelp, AnyDesk) for persistence, and direct database-table exfiltration via PaperCut's embedded Apache Derby database rather than full code execution. CISA added both 2026 CVEs to the KEV catalog that same day (2026-08-31). PaperCut shipped a third emergency patch on 2026-09-01, explicitly fixing two known regressions introduced by Release 2 in addition to further hardening — the current patch baseline as of this compile. No threat actor has been publicly attributed to any of the 2026 activity. The 47%-unpatched install-base figure and Shadowserver's 800+ internet-exposed-server count together indicate the opportunity for broader exploitation remains wide open despite three patch generations in six days.

The two generations sit at opposite ends of the disclosure-maturity spectrum. The 2023 process is close to a model coordinated-disclosure timeline: a researcher-to-vendor report through an established program (ZDI), a two-month remediation window, a patch that shipped before the public advisory, and an advisory that shipped before any known exploitation. What still went wrong was entirely on the deployment side — the population of internet-facing PaperCut servers patched too slowly relative to how fast ransomware affiliates could reverse-engineer the fix, a gap of roughly five weeks that a diverse set of financially motivated and state-sponsored actors all independently found and exploited before most administrators acted.

The 2026 process is the inverse: PaperCut had no advance warning from a researcher and found out about the flaw the same way most vendors least want to — from a security vendor detecting it being actively exploited in a customer's environment. Shipping a same-day patch under that pressure is a reasonably strong response, but the fact that watchTowr's independent reproduction effort found the patch bypassable within roughly a day is a meaningful signal: an emergency patch built under active-incident time pressure, without the multi-week validation window a coordinated disclosure affords, is measurably more likely to leave gaps. PaperCut's willingness to ship a second emergency patch within 24 hours and explicitly tell customers to reapply — rather than quietly patching the gap in a later release — is the right call operationally, but it also means any organization that patched on 2026-08-27 and considered the matter closed was, for roughly a day, still exposed.

2023 chain end-to-end (CVE-2023-27350 → RCE). An unauthenticated attacker with network access to a PaperCut Application Server's web interface navigates to the SetupCompleted page and submits its login form. Due to the Session Puzzling defect, the server treats this as a successful admin login without checking a password. The attacker, now holding an authenticated admin session, opens the Device/Print Scripting configuration for any printer and inserts JavaScript that spawns a system command. The next print event — or a manually triggered test — executes that script under SYSTEM privileges on the Windows host running the Application Server, or as the local service account on Linux/macOS deployments.

2026 chain end-to-end (CVE-2026-81578 → CVE-2026-82078). An unauthenticated attacker sends a crafted HTTP request that names one URL path for the page-rendering logic to process while its actual parameters target a different, privileged backend component. Because PaperCut's authorization check validates the declared rendering path rather than the component that ultimately executes, the attacker can write to server configuration — specifically, the database-connection driver-name setting — without ever authenticating. The attacker then supplies a driver-name value that resolves to a malicious Java class already staged on the server's classpath (delivered, in Huntress's reproduction, via an SMB2 share hosting a crafted Apache Derby database archive). When PaperCut's database utility code next instantiates a JDBC driver using that unvalidated name (CVE-2026-82078), it loads and executes the attacker's class — achieving remote code execution under the PaperCut Application Server process (pc-app.exe on Windows) with no authentication at any stage.

No card currently on file in this repository documents Bl00dy Ransomware Gang, Cl0p, LockBit, Lace Tempest/TA505, MuddyWater/Mango Sandstorm, or Mint Sandstorm as named threat actors — see Section 10. The 2023 chain stands out even among mass-exploited CVEs for the sheer diversity of actor types that independently converged on it within roughly two weeks: financially motivated ransomware affiliates, an initial-access-broker-adjacent malware operator (TrueBot/Silence), and two distinct nation-state espionage services, all drawn to the same unauthenticated RCE primitive. The 2026 chain's exploitation has widened materially since first observed — from two isolated customer intrusions to continuous honeypot-confirmed scanning, RAT deployment for persistence, and a separate database-exfiltration pattern — but as of this compile no threat actor or campaign name has been publicly attached to any of it, a genuine intelligence gap rather than an indication of limited scope.

PaperCut's two generations of pre-auth RCE, three years apart, are best read not as one vendor being unlucky twice but as a structural property of a specific application shape: a Java-based web console that (a) exposes both public/unauthenticated pages and privileged administrative actions behind a single, shared request-routing and authorization layer, and (b) deliberately offers admins a legitimate code-execution feature — scripting hooks, driver/plugin loading — as a product capability rather than an edge case. Every part of that shape is individually reasonable from a product-design standpoint: setup wizards need an unauthenticated entry point, admins legitimately need to script device behavior and configure database drivers. The vulnerability class emerges specifically from the seams between those reasonable features — the point where "this page doesn't need auth" logic and "this action needs auth" logic share enough code that a request can walk through the former and land in the latter.

This is architecturally the same lesson PrintNightmare taught about the Windows Print Spooler, applied to a different technology stack: a legitimate, admin-facing "install code that runs with elevated privilege" feature (Point-and-Print driver installation there; Device Scripting and JDBC driver loading here) is safe only as long as the authorization boundary in front of it is airtight, and airtight authorization boundaries are exactly the kind of property that is easy to state and hard to verify across a large, evolving codebase. The 2026 vulnerability's specific mechanism — validating the wrong artifact (the rendered page) instead of the artifact that matters (the invoked backend component) — is a textbook confused-deputy pattern, and it is precisely the kind of defect that unit tests focused on "does this page require login" will not catch, because the page in isolation does require login; the flaw only appears in how two independently-correct-looking checks compose.

The organizational lesson from the 2026 disclosure cadence is equally instructive: PaperCut's first emergency patch, built in roughly 24 hours under active-incident pressure with no advance coordinated-disclosure window, was bypassable within a comparable timeframe by an independent research team. This is not a criticism unique to PaperCut — it is a general property of emergency patching under public pressure — but it argues for a specific defensive posture: treat any same-day emergency patch for an actively-exploited authorization flaw as provisional rather than final, and expect a fast-follow. Organizations that applied only the first 2026 patch and stopped monitoring the vendor's advisory page were, for a real window, no safer than before it existed.

The Jetty container version disclosed in the Server header identifies the underlying embedded web server, not the PaperCut application version layered on top of it — the same Jetty build can host multiple PaperCut releases spanning both vulnerable and patched status. Treat any internet-reachable PaperCut instance as vulnerable-until-proven-patched rather than attempting remote version fingerprinting; the population of exposed instances documented in Section 01 (Shadowserver's 800+ count) reflects exactly this — reachability, not confirmed vulnerability.

Version not reliably discriminated via banner — this response body text is identical across every NG/MF release researched for this compile and is used purely as a product-identification fingerprint (runZero, 2026), not a patch-status indicator. This is the same finding as PrintNightmare's Section 11 in this repository: for authorization-logic vulnerabilities, network banners answer "is this the product" but not "is this patched."

No dedicated built-in NSE script exists for any CVE in the PaperCut family (CVE-2023-27350, CVE-2023-27351, CVE-2026-81578, CVE-2026-82078) as of this compile. The practical, source-documented alternative is Rapid7's Metasploit module exploit/multi/http/papercut_ng_auth_bypass, which implements the 2023 SetupCompleted/Device-Scripting chain end-to-end and can be run in check-only mode against a non-production target to confirm exploitability without deploying a payload. No comparable public Metasploit or Nmap tooling for the 2026 chain (CVE-2026-81578/82078) was identified in research reviewed for this compile — the primary public technical references remain Huntress's and eSentire's write-up-level analyses rather than a packaged scanning tool.