Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using PaperCut NG and MF
Incident: Exploitation of chained vulnerabilities CVE-2026-82078 and CVE-2026-81578 for remote code execution.
Impact: Full system compromise allowing attackers to execute arbitrary code and potentially exfiltrate sensitive print data.
Attacker: Unidentified threat actors
Analysis: Threat actors are exploiting a combination of improper access control and unsafe dynamic class loading to bypass authentication. This chain allows the execution of arbitrary Java code within the application process. Early evidence shows attackers using encoded commands to fingerprint targeted systems for further pivoting.
Recommendations: Immediately apply the latest emergency hardening patches from PaperCut.; Restrict public internet access to PaperCut management interfaces.; Audit server logs for ‘Database error looking up cardID: VALUES CAST’ indicators.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-31 07:33 UTC
Active exploitation of two zero-day vulnerabilities allowing unauthenticated remote code execution. Full compromise of the PaperCut server process via remote code execution. The exploit chain utilizes an authentication bypass (CVE-2026-81578) paired with a critical dynamic class loading flaw (CVE-2026-82078). Together, these allow unauthenticated attackers to modify system configurations and execute arbitrary Java bytecode. While current activity has focused on system discovery, the capabilities provide a direct path to full server compromise.
Corroborating source: securityweek.com
Update — 2026-09-11 07:43 UTC
Large-scale exploitation of PaperCut vulnerabilities using AI-driven automation. Unauthorized authentication bypass and arbitrary code execution across nearly 400 organizations. The campaign utilizes CVE-2026-81578 and CVE-2026-82078 to gain unauthorized access and execute code on PaperCut servers. Notably, the attacker employs AI-powered agents to scale their operations, specifically targeting the US education sector while avoiding certain geopolitical regions.
Corroborating source: thehackernews.com