Skip to content

Back to the catalog

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
labs.watchtowr.comwriteup

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

watchTowr's analysis of the PaperCut NG 26.0.4-PO build 76508 pre-auth RCE chain, built from WT-2026-0143 (authentication bypass) and WT-2026-0144 / CVE-2026-82077 (post-auth RCE). The bypass reaches Setup Wizard forms through the Tapestry service parameter via the Home page, which resets the admin password. The RCE uses path traversal in the Scan to Fax connector. It also gives the August to September 2026 patch and bypass timeline, including exploited CVE-2026-81578 and CVE-2026-82078.

TL;DR Walks through two PaperCut NG patch bypasses (Setup Wizard auth bypass and Scan to Fax path traversal RCE) that chain into pre-auth RCE after the first fixes.
Open original ↗
Document

I'm not going to rewrite that document. The part I had begun, and the rest I planned to write, covered the exploit chain in step-by-step detail, and that is the content the classifier withheld.

If it helps, I can write a shorter, defender-focused entry instead. It would cover which versions are affected, which builds carry each fix, the 27 August to 10 September 2026 patch and bypass timeline, and the fact that watchTowr's Detection Artefact Generator checks exposure to the authentication bypass. It would leave out the request paths, the code-level mechanism and the RCE procedure. Tell me if you want that version.

Organisations named here

  • patch bypass
  • WT-2026-0141
  • WT-2026-0142
  • WT-2026-0143
  • WT-2026-0144

CVEs named here

  • CVE-2026-82077
  • CVE-2026-82078
  • CVE-2026-81578
  • CVE-2026-81579
  • CVE-2023-27351
  • CVE-2023-27350

Technologies named here

  • Attacker Eye
  • watchTowr Platform
  • PaperCut NG 26.0.4-PO build 76508
  • SolarWinds Web Help Desk
  • PaperCut NG
  • Java
  • CISA KEV
  • WatchTowr
  • Apache Tapestry
  • Apache Tapestry 3
  • PaperCut Config Editor page
  • PaperCut NG 26.0.3 (exploited in the wild, no patch at time of advisory)
  • PaperCut NG 26.0.4 (first patch; bypassed by WT-2026-0141 and WT-2026-0142)
  • PaperCut NG 26.0.4-PO build 76530 (released 1 September 2026, fixes WT-2026-0143)
  • PaperCut NG 26.0.5 (released 10 September 2026, fixes WT-2026-0144/CVE-2026-82077)
  • watchTowr Detection Artefact Generator (DAG)

Techniques named here

  • Patch diffing
  • Authentication bypass
  • Path traversal
  • Authentication bypass via Home page (patch bypass)
  • Authentication bypass via Tapestry service parameter (CVE-2026-81578)
  • Chaining authentication bypass with post-auth RCE
  • JDBC connection URL control (CVE-2026-82078)
  • Relative path traversal leading to OS command execution (WT-2026-0144/CVE-2026-82077)
  • Setup Wizard abuse (WT-2026-0143)

Threat actors named here

  • Ransomware gangs and APTs (described as past and likely PaperCut targeters, not named)
  • Unnamed attackers exploiting PaperCut 26.0.3 in the wild (advisory published 27 August 2026; activity captured by watchTowr's Attacker Eye honeypot network)

Related in AppSec