PaperCut's RCE Chain Is a Reminder to Get Admin Consoles Off the Internet

Most of the people who read this blog run mail, not print servers, so let me be honest up front: if you don't have PaperCut NG or MF anywhere in your estate, you can close this tab. But a lot of us run it next to the mail infrastructure — it's the thing that meters departmental printing and holds scanned documents — and the way this one broke is worth understanding even if you're patched, because it rhymes with problems we already know from Zimbra.

What actually happened

PaperCut shipped an emergency fix, then a second one, for two flaws that attackers are chaining in the wild. The Hacker News, drawing on Huntress and watchTowr, lays out the mechanics: CVE-2026-81578 (CVSS 8.8) is an access-control bug in the web management interface where an unauthenticated request can trigger backend actions before the permission check finishes. CVE-2026-82078 (CVSS 9.4) is unsafe dynamic class loading in the database connection utilities — the app will instantiate a driver class from a configurable name without checking it against an allowlist.

Neither is catastrophic alone. Chained, they are. watchTowr's Jake Knott describes the sequence plainly: use 81578 to bypass authentication, edit a configuration file, and use that to hit 82078 for remote code execution. Huntress frames the core of it as an authorization check that trusts the rendered page while missing the permissions required by the component behind it — a classic mismatch between what the UI shows and what the action underneath actually does.

BleepingComputer also reported the zero-day exploitation, corroborating that this is being used, not theorised.

Patching is necessary but not the finish line

Here is the part that should change your Monday. watchTowr says it found multiple patch bypasses, and — critically — that new bypasses affect the latest, fully patched version. So applying the update is table stakes; it does not let you tell your boss the box is safe if it's still reachable from the internet.

The guidance The Hacker News relays is the right one regardless of patch state: remove public internet exposure, and restrict the Application Server's web interface to trusted IPs or put it behind a VPN. If you've administered Zimbra through its string of internet-facing RCEs, this is muscle memory. An admin console written in Java, exposed to the world, is a standing liability whether the current CVE count is zero or two. The console should never have been on a public address in the first place.

Hunting for compromise

If you run PaperCut and it's been reachable, assume you need to look, not just patch. The observed post-exploitation was quiet — Huntress described Base64-encoded commands running whoami & ver (and in a later incident whoami & ver & tasklist) to fingerprint the host, plus an OS-agnostic Java .class file that dumps a directory listing to a file named Udydn.out under a /data/content/ path relative to the install directory. The attackers then delete that file along with the server's server.log and /data/internal/derby.log — so missing or truncated logs are themselves a signal. Knott points to Database error looking up cardID: VALUES CAST errors in the logs as an indicator to grep for.

Huntress says it's only seen limited exploitation across two environments so far and can't yet tell what the actors ultimately want — the activity looks like reconnaissance and validation. That's the calm before someone monetises it. Knott's point about why PaperCut is attractive lands for anyone storing scanned documents: it's an internet-facing pivot into the corporate network and, if print jobs are retained, a document trove worth exfiltrating.

The unglamorous takeaway is the same one that has saved Zimbra shops for years: the management interface of any server-side Java application belongs behind your perimeter, full stop.

Sources

• The Hacker News
• BleepingComputer