Dark Web Intelligence (@DailyDarkWeb) on X

What it is

watchTowr published research on Oct 9, 2026 showing an unauthenticated RCE chain against PaperCut NG 26.0.4-PO build 76508. That build is the emergency release shipped after the August in-the-wild attacks, so it is not a safe stopping point.

How it works

Two bugs are chained:

• WT-2026-0143 (no CVE): an auth bypass that re-runs the Setup Wizard through the Home page, which resets the admin password.
• CVE-2026-82077 (WT-2026-0144): a Scan-to-Fax path traversal that leads to OS command execution.

On its own, CVE-2026-82077 requires admin access (vendor CVSS 4.0: 7.3). The bypass supplies that access, which is what makes the chain unauthenticated.

Preconditions / Affected

• Builds from the emergency release line, such as 26.0.4-PO build 76508, are affected by the chain.
• The attacker needs to reach the admin web interface.

What to do

• Upgrade NG/MF to 26.0.5, or to 25.0.13 on the 25.x branch, or later. Both bugs are fixed only with the second patch:
• The auth bypass was fixed in build 76530 (Sep 1).
• CVE-2026-82077 was fixed in 26.0.5 (Sep 10).
• Check exact build numbers rather than relying on the version label. Replace any interim emergency builds, since a build that fixes only the bypass still carries the path traversal.
• Keep the admin web interface off the internet.
• watchTowr released a detection tool, but it checks for the auth bypass only. A clean result says nothing about CVE-2026-82077.

Caveats

• Exploitation of this chain is unconfirmed. The August attacks used CVE-2026-81578 and CVE-2026-82078, which are different bugs.
• The details are now public, so the risk of exploitation rises.
• This is a secondhand social post summarizing watchTowr's write-up. Confirm the build boundaries against the vendor advisory and the watchTowr post before relying on them.