Print management software is not where most security teams expect to find their next incident. That is precisely why the two vulnerabilities PaperCut disclosed on 27 August are worth attention: CVE-2026-81578, a CVSS 8.8 authentication bypass, and CVE-2026-82078, a CVSS 9.4 unsafe dynamic class loading flaw, chain together into unauthenticated remote code execution against a class of server that sits quietly inside almost every large print estate and rarely gets patched with any urgency. PaperCut's own advisory was blunt about the stakes: "we are aware of confirmed customer incidents and are treating this matter with the highest priority," as The Hacker News reported.
How an admin console became reachable without a login
CVE-2026-81578 does not need credentials. It works by abusing the "complex direct" request format in Apache Tapestry, the framework PaperCut's admin interface is built on, to render a public-facing page - Error, Exception or Home - while quietly invoking administrative components from ConfigEditor or UserList underneath it. The request looks, on the wire, like someone loading a page they were always allowed to see. What it actually does is reach components that were never meant to answer to an anonymous caller. That mismatch between what a request appears to be and what it actually triggers is the same category of flaw that has made application frameworks a recurring soft spot across 2026 - a framework doing exactly what it was told, by a caller it should never have trusted.
From a console to code execution
Reaching the admin console is the first half of the chain, not the whole of it. From there, CVE-2026-82078 lets an attacker reconfigure four external database lookup settings - including the JDBC driver and the SQL statements PaperCut runs against it - then trigger that lookup. According to Rapid7's technical breakdown, the exploit routes through Apache Derby's foreignViews feature to open an H2 JDBC connection carrying a JavaScript-backed trigger - a legitimate database interoperability feature repurposed into a code execution primitive. Nothing in that chain requires a memory corruption bug or a fuzzer-found edge case. It requires two features working exactly as designed, reached in an order their designers didn't anticipate an anonymous user reaching them in.
Why the first patch wasn't the last one
PaperCut released its emergency fix for versions 25 and 26 at 02:10 AEST on 28 August, with a version 24 patch following later the same day. That would ordinarily be the end of the story. It wasn't: researchers found the initial fix could still be bypassed via the product's own Home page, and PaperCut had to ship a corrected version before the day was out, as BleepingComputer detailed. That sequence is a useful, if uncomfortable, reminder for any organisation treating "we patched" as the end of an incident timeline - a first patch against an actively exploited chain deserves the same verification a second patch would, because the attacker doesn't stop probing just because a fix shipped.
What to check right now
- Confirm your PaperCut NG/MF estate is running the corrected patch for version 24, 25 or 26 - not just "a patch," since the first release for v25/v26 was itself bypassable.
- Search server.log for the indicators PaperCut published: unexpected
pc-app.exeactivity, missing or truncated log files, and the errors "No suitable driver found for jdbc:no:x" and "Database error looking up cardID: VALUES CAST". - Treat a public-facing PaperCut server with no recent patch history as a priority incident-response target, not a routine update, given confirmed exploitation predates the fix.
- Review who can reach the PaperCut admin interface from outside your network at all - the authentication bypass only matters to an attacker who can send it a request in the first place.
- Don't assume absence of the published indicators means a server is clean; PaperCut's own advisory notes that IOC list is not exhaustive.
A print server is exactly the kind of asset that survives in an estate for years without anyone re-examining what it's exposed to - a problem we've flagged before in edge and infrastructure devices like the Cisco ASA/FTD firewalls under active exploitation this month. If you'd like help finding the quiet corners of your estate that carry this kind of risk, email sales@halfteck.com.