The U.S. Cybersecurity and Infrastructure Security Agency added two PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities catalog on August 31, 2026, confirming what security researchers had been warning about for four days: a print management platform used by more than 70,000 organizations worldwide has a working, unauthenticated path to remote code execution, and attackers are already using it.

The two flaws, CVE-2026-81578 and CVE-2026-82078, chain together into a pre-authentication exploit that lets an attacker reach a PaperCut server over the network, rewrite its configuration without logging in, then trigger arbitrary Java code execution on the underlying host. PaperCut disclosed both bugs on August 27, 2026, and by August 28 had already shipped a second emergency patch after researchers at watchTowr and Huntress found ways around the first one, according to reporting from SecurityWeek and BleepingComputer. Huntress says it caught the first real-world exploitation attempts on August 26, before the public disclosure had even finished circulating.

What CISA’s KEV Listing Actually Means Here

CISA doesn’t add a CVE to the Known Exploited Vulnerabilities catalog because a bug looks dangerous on paper. The listing is reserved for flaws with confirmed evidence of exploitation in the wild, and it comes with teeth: under CISA’s binding operational directive, U.S. federal civilian executive branch agencies now have until September 14, 2026, to patch or otherwise remediate any exposed PaperCut NG/MF instance. Private companies aren’t legally bound by that deadline, but the KEV listing functions as an industry-wide signal that the theoretical risk window has closed and the practical one is open.

What makes this addition notable is the speed. PaperCut’s own disclosure landed on August 27. CISA’s KEV entry followed just four days later, on August 31, a turnaround that reflects how quickly exploitation evidence accumulated rather than any slowness on the agency’s part. Compare that to flaws that sit disclosed-but-unexploited for months before anyone weaponizes them: this one didn’t get that grace period.

Inside the Exploit Chain: How Two Separate Bugs Become One RCE

CVE-2026-81578 is an improper access control flaw in the web management interface shared by PaperCut NG and PaperCut MF. According to cybersecuritynews.com, it lets an unauthenticated remote attacker modify system configuration values that should require an administrator login. On its own, that’s a serious but contained problem: an attacker can tamper with settings, not run code.

CVE-2026-82078 is where the damage actually happens. The flaw sits in PaperCut’s database connection utilities, which instantiate database driver classes based on driver names pulled from the application’s own configuration. The code doesn’t check those driver names against an allowlist before loading them. An attacker who can control that configuration value, which is exactly what CVE-2026-81578 hands them without a password, can point PaperCut at a malicious driver class and get it to execute arbitrary Java code on the server. Rapid7’s advisory frames the two bugs as a matched pair by design: 81578 opens the door, 82078 walks through it.

The result is pre-authentication remote code execution against any internet-reachable PaperCut NG/MF server that hasn’t been patched. No credentials, no phishing, no user interaction. That combination is precisely what tends to produce mass-scanning campaigns within days of disclosure, since automated tooling for chaining the two requests is trivial to build once the technical details are public.

DetailCVE-2026-81578CVE-2026-82078
Vulnerability typeImproper / missing access controlUnsafe dynamic class loading
LocationWeb management interfaceDatabase connection utilities
CVSS score8.8 (High)9.4 (Critical)
Authentication requiredNoneNone (chained via 81578)
ImpactUnauthorized config modificationArbitrary Java code execution
DisclosedAugust 27, 2026August 27, 2026
Added to CISA KEVAugust 31, 2026August 31, 2026

Timeline: Four Days From Disclosure to a Federal Deadline

Huntress reports that it identified the first exploitation attempts against its customers on August 26, 2026, a day before PaperCut’s own public disclosure. That detail matters because it suggests either a leak of pre-disclosure technical details or independent discovery by attackers running their own research against the software in parallel with PaperCut’s internal team, a pattern security researchers have seen before with widely deployed enterprise software.

PaperCut disclosed both CVEs on August 27 and shipped an initial emergency patch the same day, covering PaperCut NG/MF versions 24, 25, and 26 across Windows, Linux, and macOS. That patch didn’t hold. Working with watchTowr and Huntress researchers, PaperCut identified bypass techniques against the first fix and issued a second emergency patch release, Emergency Patch Release 2, on August 28, per BleepingComputer’s reporting. Four days later, on August 31, CISA formalized the exploitation status by adding both CVEs to the KEV catalog and setting the September 14 remediation deadline for federal systems.

Why the First Patch Didn’t Hold

Emergency patches written under pressure, within hours of a zero-day going public, routinely miss edge cases that a slower, more deliberate patch cycle would catch. That’s what appears to have happened here. Researchers found ways to reconstruct the exploit chain despite the initial fix, forcing PaperCut into a second release cycle within 24 hours. It’s a pattern security teams should expect to see again: the first patch buys time, not certainty, and organizations that applied only Emergency Patch Release 1 and stopped there are very likely still exposed.

Who’s Actually Being Hit

Huntress has confirmed exploitation activity against at least two customer environments as of its initial detection window, and describes the attack as a pre-authentication RCE chain being actively used rather than a proof-of-concept sitting in a research lab. The company’s advisory frames this as an active, ongoing incident, not a theoretical warning. Neither Huntress nor Rapid7 has published a full victim count, and given how early the exploitation window still is, any number reported this week should be read as a floor, not a ceiling.

The organizations most exposed right now are the ones that treat print management as invisible infrastructure: set up once, rarely audited, and left reachable from wherever it was convenient to reach it from years ago. PaperCut servers are often domain-joined for authentication convenience, which means a compromised print server isn’t just a print server anymore. It’s a foothold with a plausible path toward the rest of the internal network.

That domain-join detail is worth sitting with. A print management server doesn’t hold customer records or financial data on its own, so it rarely shows up on a list of crown-jewel systems that get prioritized for hardening. But it typically needs an Active Directory service account to look up users and print quotas, and that account’s permissions become the attacker’s permissions the moment code execution is achieved. Ransomware affiliates have learned to specifically hunt for exactly this class of system: unglamorous, under-monitored, and quietly connected to everything that matters.

Why Print Servers Keep Becoming High-Value Targets

Print management software occupies an odd spot in enterprise security. It’s rarely internet-facing by design, but organizations expose it anyway, for remote printing, for multi-site deployments, or simply because nobody revisited the firewall rule after the initial rollout. It’s also frequently domain-joined, since PaperCut and similar platforms need to authenticate against Active Directory to track print jobs by user. That combination, an internet-reachable service with domain credentials nearby, is exactly the profile ransomware affiliates look for.

Education institutions, in particular, tend to run print management at scale across dozens of buildings and thousands of endpoints, with IT teams stretched thin and patch cycles slower than in the private sector. That’s not speculation about this specific incident; it’s a pattern documented in PaperCut’s last major exploitation event, and it’s worth understanding in detail because history here is unusually direct.

PaperCut’s 2023 Precedent: This Isn’t the Software’s First KEV Entry

PaperCut has been through this before. CVE-2023-27350, an unauthenticated remote code execution flaw in the same NG/MF product line, was exploited starting in mid-April 2023. Microsoft and SecurityWeek reported that a ransomware operator linked to the Cl0p group, tracked alongside the FIN11 and TA505 threat clusters, was exploiting the bug within weeks of disclosure. Separately, CISA’s own advisory, AA23-131A, documented the Bl00dy ransomware gang using the same vulnerability to break into networks across the education sector, where PaperCut’s install base is especially dense.

Rapid7’s 2023 tracking of that incident put PaperCut’s footprint at more than 70,000 organizations and over 100 million users worldwide, a scale that turned one vulnerable code path into a monthslong exploitation wave rather than a contained incident. That scale hasn’t shrunk. If anything, three additional years of adoption in education and enterprise print fleets makes the current exploit chain a candidate for a similarly long tail, unless patching moves faster this time than it did in 2023.

IncidentDisclosedCVSSKnown exploitersPrimary target sector
CVE-2023-27350March 20239.8Cl0p-linked FIN11/TA505, Bl00dy Ransomware GangEducation, enterprise
CVE-2026-81578 + CVE-2026-82078August 27, 20268.8 / 9.4Unattributed, active as of Huntress detectionUnconfirmed, early stage

Market Impact: What This Costs MSPs and IT Teams

PaperCut’s customer base skews heavily toward managed service providers running print fleets for multiple clients, which means a single unpatched deployment can multiply into dozens of exposed downstream organizations. For MSPs, this incident forces an uncomfortable audit: every client environment running PaperCut NG/MF needs to be identified, checked against the emergency patch version, and re-verified after Emergency Patch Release 2, since applying only the first release leaves the bypass path open.

There’s also a reputational cost that outlasts the technical fix. The 2023 incident became a case study cited in security training material for years afterward, and this one is likely to join it, particularly if exploitation follows the same education-sector pattern. Print management vendors don’t typically make headlines, which means when one does, twice in three years, the scrutiny on the entire product category tends to rise, not just on the single vendor involved.

Cyber insurance underwriters tend to move faster than most people expect once a KEV entry lands on a widely deployed product. Renewal questionnaires increasingly ask specifically about patch cadence on named CVEs rather than generic “do you patch regularly” language, and a documented gap between the August 27 disclosure and an organization’s actual patch date could become the difference between a smooth renewal and a coverage dispute if an incident happens in between. That’s a cost that shows up on a balance sheet months after the technical story has faded from the news cycle.

How This Compares to Other 2026 KEV Additions

PaperCut’s exploit chain lands in a year that has already put several unauthenticated, high-severity flaws onto CISA’s exploited list. The pattern across nearly all of them is the same: a component that shouldn’t be internet-facing ends up exposed anyway, and attackers move within days rather than weeks once the technical details go public.

CVEProductCVSSNotable detail
CVE-2026-81578 / 82078PaperCut NG/MF8.8 / 9.470,000+ organizations run the software
CVE-2026-21962Oracle WebLogic10.0140,000 attacks recorded in 12 days
CVE-2026-41940cPanel/WHM9.81.5 million servers exposed
CVE-2026-64849MLflow9.3Used to steal live cloud credentials
CVE-2026-50751Check Point VPN9.3Linked to Qilin ransomware deployment
CVE-2026-4342Kubernetes ingress-nginx8.8Remained unpatched at time of disclosure

What sets PaperCut apart from most of that list is install-base density rather than raw severity. A CVSS 10.0 bug in a niche enterprise product can still produce a smaller real-world blast radius than a CVSS 8.8 bug in software running on tens of thousands of networks. PaperCut’s history in 2023 already proved that scale, not score, tends to drive how long an exploitation wave lasts.

Detecting Exposure: What to Check Right Now

Security teams reviewing this incident should start by confirming whether any PaperCut NG/MF admin interface is reachable from outside the corporate network, since both CVEs depend on network access to that interface to work. A basic external port and service scan against known PaperCut ports, followed by a check of the running version against Emergency Patch Release 2, covers the immediate triage.

# Quick triage checklist for PaperCut NG/MF exposure
# 1. Identify internet-facing PaperCut instances
nmap -p 9191,9192,9163 --open 

# 2. Confirm patch level from the admin console
#    Should show Emergency Patch Release 2 (Aug 28, 2026) or later
#    Versions 24.x, 25.x, and 26.x all require the update

# 3. Review server logs for unexpected config changes
#    or unfamiliar database driver class references

# 4. Restrict the admin web interface to internal-only access
#    regardless of patch status, as defense in depth

That log review step matters as much as the patch itself. Because CVE-2026-81578 allows configuration changes without authentication, organizations that were exposed before patching should not assume patching alone resolves the incident. A malicious database driver reference planted during the exposure window could persist through an update unless it’s specifically found and removed.

What IT Teams Should Do This Week

The immediate action is straightforward: confirm every PaperCut NG/MF instance is running Emergency Patch Release 2 or later, not just the first emergency patch from August 27. Organizations that can’t patch immediately should pull the admin interface off any public-facing network segment as an interim step, since both CVEs require network reachability to the web management interface to function.

For MSPs managing PaperCut across multiple client environments, the priority is building an accurate inventory before assuming coverage. The 2023 incident showed that exploitation waves against this specific product tend to run for months once they start, driven by the long tail of organizations that either didn’t know they were running PaperCut or didn’t prioritize the patch until an incident forced the issue.

Incident response teams handling a suspected compromise should treat any PaperCut server that was internet-reachable before August 28 as potentially compromised, not just potentially vulnerable. Because CVE-2026-81578 permits unauthenticated configuration writes, the safest assumption is that an attacker had a window to make changes even if no obvious damage is visible yet. That means checking for new scheduled tasks, unfamiliar service accounts, and outbound connections from the PaperCut host, in addition to the driver-class review already covered above. Rebuilding from a known-clean backup remains the most reliable option for any instance with confirmed pre-patch internet exposure.

Predictions: Where This Goes From Here

  • Expect a named ransomware affiliate to be publicly linked to this exploit chain within the next two to four weeks, echoing the Cl0p and Bl00dy pattern from the 2023 incident.
  • Education-sector networks are likely to feature disproportionately among confirmed victims once attribution research catches up, given PaperCut’s historical concentration in that sector and typically slower patch cycles.
  • A third emergency patch or hardening update is plausible within weeks if researchers continue probing the driver-loading logic behind CVE-2026-82078, since one bypass has already been found and fixed under time pressure.
  • Federal agencies will largely meet the September 14 deadline given CISA’s binding directive, but small businesses and school districts relying on outside MSPs will form the long tail of unpatched, exploitable instances for months afterward.
  • Security vendors including Huntress and Rapid7 will likely publish detection rules and indicators of compromise within days, but the value of those rules depends entirely on organizations actually knowing they run PaperCut in the first place.

Frequently Asked Questions

What is CVE-2026-81578?

It’s an improper access control vulnerability in the web management interface of PaperCut NG and PaperCut MF, rated CVSS 8.8, that lets an unauthenticated attacker modify system configuration settings.

What is CVE-2026-82078?

It’s a critical unsafe dynamic class loading flaw, rated CVSS 9.4, in PaperCut’s database connection utilities. Combined with CVE-2026-81578, it allows arbitrary Java code execution without authentication.

Is PaperCut NG/MF being actively exploited right now?

Yes. Huntress detected exploitation attempts starting August 26, 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, a designation reserved for confirmed real-world exploitation.

Which PaperCut versions are affected?

All versions of PaperCut NG and PaperCut MF prior to the August 27, 2026 patch are affected, spanning the 24, 25, and 26 release lines on Windows, Linux, and macOS.

How do I patch against these vulnerabilities?

Apply Emergency Patch Release 2, published August 28, 2026. The first emergency patch from August 27 was found to have a bypass, so organizations running only that initial fix remain exposed.

Not technically, but it follows a similar pattern. CVE-2023-27350 was an unauthenticated RCE flaw in the same NG/MF product line, exploited by Cl0p-linked actors and the Bl00dy ransomware gang starting in 2023.

Does CISA’s federal deadline apply to my organization?

The binding September 14, 2026 deadline applies specifically to U.S. federal civilian executive branch agencies. Private organizations aren’t legally bound by it but face identical real-world exploitation risk.

What should I do if I can’t patch immediately?

Remove the PaperCut admin web interface from any internet-facing network segment as an interim step, since both vulnerabilities require network access to that interface, and review logs for unauthorized configuration changes made before patching.