PaperCut NG and PaperCut MF are self-hosted print-management servers: they administer queues, quotas, charging and reporting, and support secure print release. MF also connects directly to multifunction devices for copy, scan and fax workflows. That puts the software in schools and universities, healthcare providers, local government, legal practices, coworking operations and businesses that run shared printers across one or many sites.
CVE-2026-81578 is an authentication bypass in the products’ web management interface. A remote attacker needs no account or prior foothold: under particular conditions, a request aimed at an administrative function can make the server perform its backend action before its access-validation checks have completed. The immediate documented outcome is modification of certain system configuration.
A page check protected the wrong action
The important detail is not a stolen administrator password. The application accepted a specially formed Apache Tapestry request that named one page for rendering while invoking a component belonging to another page. Authorization was evaluated against the page selected for rendering, rather than the permissions needed by the administrative component that actually ran. PaperCut classifies the issue as missing authentication for a critical function, while its CVE record uses authentication-bypass terminology; operationally, both descriptions point to an unauthenticated route into privileged management behavior.
The flaw is more consequential when paired with CVE-2026-82078. A public, approved-but-unmerged Metasploit module pull request implements that chain for PaperCut 24.x, 25.x and 26.x. Huntress also recreated a working proof of concept and observed pre-authentication code execution under the Application Server process. So public exploit code does exist; neither the vendor patch source nor a source-code diff has been published.
Exploitation is confirmed, attribution is not
This is not a theoretical exposure. PaperCut has confirmed customer incidents and active exploitation, while Huntress reported two affected environments. In those cases, observed commands enumerated users, operating-system details and processes, and attacker-provided Java classes bridged the PaperCut service to operating-system command execution. Broader vendor observations include a SimpleHelp agent installed as a Windows service and an AnyDesk download, though those reports are not necessarily the same two incidents.
CISA added CVE-2026-81578 to its Known Exploited Vulnerabilities catalog on August 31, 2026, with a September 14 remediation due date. Public reporting has not attributed the activity to an actor or established campaign, and known ransomware use is recorded as unknown.
Release 2, not the first emergency fix
PaperCut's first emergency patch, released for versions 25 and 26, was incomplete. Teams that applied it must replace it with Emergency Patch Release 2. Release 2 covers NG and MF branches 24, 25 and 26 on Windows, Linux and macOS; version 23 and earlier require an upgrade. Update the Application Server, Site Servers and secondary or print servers, and restrict any internet-accessible Application Server to trusted IP addresses even after patching.
Treat suspected compromise as an incident, not simply a patching task: PaperCut recommends rebuilding the Application Server and restoring a clean backup from before suspicious activity. The CVE record lists 24.1.10, 25.0.13 and 26.0.5 as fixed-version boundaries, but the vendor had not confirmed ordinary releases at those versions by September 1. Inventory exposed print infrastructure now; SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs.
