PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

What it is

Active in-the-wild exploitation of PaperCut NG/MF via a two-CVE chain: CVE-2026-81578 (improper access control in the web management interface, letting an unauthenticated attacker modify system configuration) and CVE-2026-82078 (unsafe dynamic class-loading in the database connection utilities, allowing execution of arbitrary Java bytecode). Chained, they give pre-auth RCE in the Application Server process. PaperCut treats all NG and MF versions as potentially affected. Huntress reproduced the full chain against a stock PaperCut NG 25.0.11.75758.

How it works

A crafted request references one page for the rendered response and a different page that owns the component/action actually executed. PaperCut's authorization check trusts the rendered page and misses the permissions required by the component behind it. An unauthenticated request abuses this to change server configuration, reach sensitive endpoints, and ultimately load attacker-controlled Java code.

Preconditions / Affected

Any unpatched NG/MF instance; public exposure of the web management interface is the exploitation path Huntress recommends removing immediately. Version 24 fixes were still in progress at original publication.

What to do

Move to the current maintenance releases, which replace emergency patch builds 1–3 (per the 9/10/26 update): PaperCut NG/MF 26.0.5, 25.0.13, and 24.1.10. If you installed any emergency patch, migrate to the appropriate maintenance release. Review your product/version release notes before upgrading. Remove public exposure of PaperCut immediately.

The original Windows v25 emergency builds were NG 25.0.12.76497 and MF 25.0.12.76496.

Detection / IOCs — check the PaperCut server.log for:

• The base64 string d2hvYW1pICYgdmVy, which decodes to:

whoami & ver

• A large hex-encoded array in the log, which is a delivered Java .class file (decompilable with Fernflower).
• A dropped file at lib/Udydn.class relative to the install directory.
• Output written to Udydn.out in a /data/content/ path relative to the install directory (the actor's code deletes it after use).

The malicious .class is OS-agnostic: it profiles the system and produces a directory listing under both Linux and Windows.

Caveats

Observed exploitation was limited — two customer environments, one incident lasting under two minutes. The maintenance-release supersession is the operative ordering constraint: earlier emergency patches (including the "Release 3" that superseded Releases 1 and 2) are now themselves superseded by the maintenance builds, so aim straight for the latest maintenance release rather than stacking patches. Release 3 also fixed collateral breakage from earlier patches (broken SAML login flows; legacy Microsoft SQL Server drivers for external card lookup).