PaperCut Releases Emergency Patch Release 2 for Actively Exploited Flaws
PaperCut confirmed the active exploitation of two flaws in NG and MF. Emergency Patch Release 2 is also intended for organizations that already deployed the original emergency fix.
PaperCut Emergency Patch Release 2 mitigates the risk of two vulnerabilities in PaperCut NG and PaperCut MF products that, according to the vendor, are being actively exploited in incidents affecting customers. The emergency fix is available for branches 24, 25 and 26 on Windows, Linux and macOS systems. The vendor recommends deploying it even for organizations that already applied the original emergency fix.
These are CVE-2026-81578 and CVE-2026-82078. The Canadian Centre for Cyber Security independently warned that both vulnerabilities are being actively exploited in the wild and that Emergency Patch Release 2 is the available remediation for versions 24 through 26.
What PaperCut Emergency Patch Delivers
CVE-2026-81578 allows authentication to be bypassed. An unauthenticated remote attacker can therefore modify selected system configurations. The second flaw, CVE-2026-82078, concerns unsafe dynamic class loading in database tools.
According to PaperCut, the combination of configuration manipulation and the second flaw could lead to the execution of arbitrary Java code in the context of the server process. The risk primarily affects PaperCut NG/MF servers accessible from the internet, which an attacker could target without credentials.
PaperCut published Emergency Patch Release 2 on August 28. As of August 31, the vendor also stated that it was still working on the full official release of the fix; however, it describes the available emergency package as a mitigation that should be applied without delay.
Recommended Steps for Administrators
Organizations operating affected installations should deploy Emergency Patch Release 2 for versions 24, 25 or 26. Importantly, according to the current guidance, the first emergency fix is not sufficient on its own.
Until the risk can be reduced through remediation, PaperCut recommends immediately blocking access to PaperCut Application Server web interfaces from untrusted internet addresses.
The vendor also added indicators of compromise. These include suspicious activity by the pc-app.exe process, unusually shortened or missing server.log files, and specific strings or files with .class, .cmd and .out extensions. These indicators are intended to help administrators investigate suspicious activity.
Exploitation Confirmed, Scope Unclear
PaperCut confirmed incidents affecting customers as well as the active exploitation of the flaws. However, the identity of the attackers, their motive and the total number of affected organizations are not known.
Subsequent activity after compromise also remains only partially understood. In some cases, PaperCut recorded reconnaissance commands and the deployment of remote-access tools, but this is not a confirmed universal procedure in all incidents.
For administrators of enterprise, school and public networks, the priority now is to verify the PaperCut version, deployment of Emergency Patch Release 2 and the availability of administrative interfaces from the internet. Further information may concern the full official fix, support for older versions and new forensic findings from the vendor.
Sources
- PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) – Confirms active exploitation, two CVEs, the release of Emergency Patch Release 2, risk mitigation and indicators of compromise.
- Canadian Centre for Cyber Security — PaperCut security advisory (AV26-858) – Independently reports active exploitation of both CVEs and the affected versions before Emergency Patch Release 2.
- BleepingComputer — PaperCut releases second emergency patch for exploited flaws – Corroborates that the second emergency fix followed findings of bypasses of the original fixes and that Huntress observed attacks in customer environments.
Verified and updated: 08/31/2026 10:49
