PaperCut's second emergency patch in two days (CVE-2026-82078)

PaperCut's second emergency patch in two days — and why its print server is a 2023 ransomware rerun

PaperCut disclosed two critical zero-days, CVE-2026-82078 and CVE-2026-81578, in its NG/MF print-management software on August 27, 2026, already under active attack. The first emergency patch got bypassed within a day, forcing a second one on August 28. If you run a PaperCut server, apply Emergency Patch Release 2 now and check whether its admin interface is reachable from the internet.

By Paul Rudenko, Security ResearcherAug 31, 20268 min read

What happened with the PaperCut vulnerabilities?

CVE-2026-81578 (CVSS 8.8) is an improper access control flaw in the PaperCut NG/MF web management interface — it lets an unauthenticated attacker edit system configuration without logging in. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading flaw in PaperCut’s database connection utilities, which can be abused to run arbitrary Java bytecode. Chained together, the two let an attacker with no credentials at all reach remote code execution on the PaperCut Application Server (Help Net Security).

Every version of PaperCut NG and PaperCut MF prior to the August 27, 2026 fix is affected. PaperCut shipped emergency patches for the NG/MF 24, 25, and 26 branches on Windows, Linux, and macOS the same day (PaperCut security bulletin). Huntress reported detecting exploitation of both flaws in two customer environments as of August 27 — this wasn’t a theoretical disclosure, it was already live.

Why did the first patch need a second patch the next day?

Here’s the part that separates this from a routine “patch now” advisory. PaperCut’s first emergency release didn’t fully close the door: researchers at watchTowr and Huntress, working with PaperCut, found ways to route around it. That forced a second emergency release — Emergency Patch Release 2 — on August 28, less than 24 hours later (BleepingComputer).

That matters for anyone who patched on the 27th and considered it done. A patch that ships under active-exploitation pressure, gets reverse-engineered within a day, and needs a follow-up fix is a sign the vendor and researchers are still racing attackers in real time — not a sign the story is over. If your update predates August 28, it’s the wrong version.

For the site owner (plain English)

PaperCut NG/MF isn’t a cloud service someone else runs for you — it’s software a business, school, or IT contractor installs on its own server to manage office or classroom printing. If that describes you, this is squarely your problem to fix, in this order:

Confirm you’re on Emergency Patch Release 2, not the August 27 patch that was already bypassed once.
Check whether the PaperCut web management interface is reachable from the internet. It typically runs on port 9191 (or 9192 for HTTPS), and a lot of print servers were set up once by a vendor years ago with that port left open for “convenience,” with nobody revisiting the decision since.
If it’s been exposed and unpatched at any point since August 27, assume it may have been touched and have someone check for unexpected admin accounts or configuration changes (see the FAQ).

None of this is really about a printer. It’s an attack-surface story: an internal admin tool that quietly became internet-reachable, on a product that has been down this exact road before. That’s what an external attack-surface scan is for — it looks at your domain from the outside, the way an attacker’s scanning tools do, and shows you what’s reachable. It won’t tell you “you have CVE-2026-82078” — no honest external scan can — but it will tell you whether a print-server admin panel like this one is sitting in the open.

How do developers and IT respond?

Apply Emergency Patch Release 2 for your NG/MF branch (24, 25, or 26) and confirm the build/version number after install, not before.
Don’t trust the first patch alone. If you applied only the August 27 fix, treat it as unpatched until you’ve confirmed Release 2 is in place.
Take the web management interface off the public internet. Restrict it to your internal network or a VPN; there’s rarely a legitimate reason for it to be reachable from anywhere in the world.
Look for signs of prior compromise if the server was exposed at any point: unexpected local/admin accounts, changed configuration values, or unfamiliar outbound connections from the print server.
References: PaperCut’s August 27 security bulletin and Huntress’s exploitation writeup.

What’s the real lesson here?

This isn’t PaperCut’s first time. In 2023, CVE-2023-27350 — a near-identical story, an unauthenticated bug in the same NG/MF web interface — was mass-exploited by the Bl00dy ransomware gang, hitting the education sector hardest (CISA AA23-131A). At the time, researchers scanning with Shodan found roughly 1,800 PaperCut servers exposed to the public internet (Huntress, April 2023) — a number nobody had a good reason for, then or now.

Three years later, the product, the vulnerability class (an unauthenticated web admin interface), and the exposure problem are all the same. What’s different each time is only the CVE number. Print servers are exactly the kind of system that gets installed once, works quietly for years, and never gets revisited — which is precisely why they keep ending up on this list.

That’s the through-line worth keeping, PaperCut or not: knowing what’s reachable on your network is what actually breaks a three-year repeat like this one. A website security checklist is a reasonable place to start.

Frequently asked questions

Is this the same PaperCut bug that caused ransomware attacks in 2023?

No — it's a different, newer pair of bugs (CVE-2026-82078 and CVE-2026-81578, disclosed August 27, 2026) in the same product line that was hit by CVE-2023-27350 three years ago. The vulnerability class is strikingly similar in both cases: an unauthenticated flaw reachable through PaperCut's web management interface, chainable into full remote code execution. In 2023 it was exploited by the Bl00dy ransomware gang, mainly against schools and colleges running exposed PaperCut servers. This new pair hasn't been tied to a named ransomware group yet, but Huntress confirmed active exploitation within hours of disclosure, so treat it with the same urgency. If your organization patched the 2023 bug and never revisited the server since, that's a signal worth acting on now, not just historical trivia.

How do I know if my organization even runs a PaperCut server, and whether it's exposed?

PaperCut NG/MF is print-management software, usually set up by an IT contractor or an internal admin to track and control printing across an office, school, or campus. Ask whoever manages your network infrastructure whether a PaperCut server exists and whether its web management interface — typically on port 9191 or 9192 — can be reached from outside your office network. Many print servers were configured for remote administration years ago and never revisited. If nobody can answer confidently, that uncertainty is itself the finding. An external attack-surface scan checks your domain from the outside, the way an attacker would, and lists what's actually reachable — including admin interfaces like this one that were never meant to be public — without needing to know in advance that PaperCut is involved.

I've applied Emergency Patch Release 2. Am I safe, or could I already be compromised?

The patch stops new exploitation attempts from succeeding, but it doesn't undo anything that happened before you applied it — and since Huntress confirmed active exploitation as early as August 27, that gap matters. If your PaperCut server was internet-facing and unpatched at any point between August 27 and whenever you applied Release 2, treat that window as a possible compromise, not a non-event. Concrete things to check: new or unexpected local administrator accounts, unfamiliar changes to PaperCut's configuration, and any outbound connections from the print server that you can't explain. If you find any of those, bring in someone for a proper incident-response check before assuming the patch alone closed the door — cleaning up an intrusion is a different job from installing an update.

Does MySecScan tell me if I have CVE-2026-82078 or CVE-2026-81578?

No, and it's worth explaining why. MySecScan is an external attack-surface scanner — it looks at your domain from the outside, the way an attacker's reconnaissance tools do, and reports what's reachable and how it's configured. It doesn't log into your servers or fingerprint exact software versions to declare "you have CVE-2026-82078," because that kind of guess is unreliable from the outside, and a wrong one would do more harm than good. What it does show you is exposure: whether an admin interface, login portal, or management panel — PaperCut's or anything else's — is sitting on the open internet when it probably shouldn't be. In a story like this one, where the same class of exposed admin panel keeps resurfacing years apart, that visibility is the part that actually prevents a repeat.