In late August 2026, threat actors launched a zero-click, pre-authentication remote code execution (RCE) campaign against PaperCut NG and MF by seamlessly chaining an authentication bypass (CVE-2026-81578) with an unsafe dynamic class-loading flaw (CVE-2026-82078). This exploit chain grants attackers maximum privileges on the underlying application server.
Following active intrusions, the vendor issued an emergency mitigation, but threat actors quickly bypassed it, forcing the release of subsequent patches for comprehensive structural hardening. PaperCut servers represent prime targets due to their deep network integration, elevated execution privileges, and direct connections to identity providers like Active Directory to manage enterprise print queues.
Print management servers require extensive, deeply integrated network access to function effectively as must communicate with virtually every endpoint, workstation, and networked printer across the organisation to manage print queues, track usage, and enforce policies.
The two-stage attack requires no prior authentication or user interaction. In stage one, attackers exploit an improper access control flaw in the Apache Tapestry web framework. By crafting a specific "complex direct" HTTP request, they bypass authentication checks by requesting a public page while secretly invoking a privileged administrative component. This allows attackers to silently overwrite external user-lookup settings with malicious database configurations.
In stage two, because PaperCut dynamically loads database drivers without a strict allowlist, the poisoned settings force the application to load a malicious Java Database Connectivity (JDBC) string. When triggered by a benign UserList search, the embedded Apache Derby driver opens an attacker-controlled H2 database URL, which parses embedded JavaScript via the Nashorn engine to natively execute arbitrary commands on the host operating system.
The observed URI structures typically take the following forms, where the integer segment in the path is arbitrary:
Initial automated reconnaissance involved Base64-encoded commands to profile target operating systems and enumerate installed security solutions. Following this, attackers dropped hex-encoded Java binaries, typically named Udydn.class or Moo97.class, into the server's filesystem for deeper profiling.
To evade detection, these payloads executed aggressive self-cleanup routines, specifically deleting the primary PaperCut server.log file to blind defenders before deleting themselves. The string d2hvYW1pICYgdmVyICYgdGFza2xpc3Q= was injected to execute whoami & ver & tasklist. By enumerating all active processes via tasklist, the threat actors were actively profiling the host environment to identify installed Endpoint Detection and Response (EDR) solutions, antivirus agents, and other security monitoring tools that might impede further payload delivery
By early September 2026, operations shifted to manual, hands-on-keyboard activity as Initial Access Brokers (IABs) deployed bespoke remote access tools and in-memory payloads to establish persistent backdoors and facilitate lateral movement. Some groups also hijacked PaperCut’s native database utilities to initiate direct data theft operations.
Log-Based Indicators: If centralised log forwarding is actively deployed, or if the payload failed to execute its cleanup routine successfully, analysts should query for the following specific artefacts
The Derby Log Anomaly: While the malicious payload successfully deleted the primary application log, it routinely failed to delete the internal Apache Derby database log file located at /data/internal/derby.log, likely due to the file being locked by the active Java process or simply overlooked during the cleanup routine.
Filesystem Artifacts: If the exploit payload failed to delete itself, or if file-integrity monitoring (FIM) and EDR solutions successfully captured the file creation events before the deletion routine executed, the following file paths are indicative of an attack:
