CVE-2026-82078 – Weekly Pwning Pick

PaperCut NG and MF print management software, used by over 100 million users across 70,000+ organizations including Fortune 500 companies, government agencies, and educational institutions, disclosed two critical zero-day vulnerabilities on August 27, 2026, that were already being exploited in active attacks. The vulnerability chain consists of two flaws: **CVE-2026-81578 (CVSS 8.8):** An improper access control vulnerability in the web management interface. The flaw exploits PaperCut's authorization logic, which could trust the rendered page while missing permissions required by the component. An unauthenticated attacker can craft specific HTTP requests that reference one page for rendering while executing actions on a different page, bypassing authentication entirely and gaining the ability to modify system configurations. **CVE-2026-82078 (CVSS 9.4):** An unsafe dynamic class-loading vulnerability in the database connection utilities. Once authenticated (via CVE-2026-81578), attackers can trigger arbitrary Java bytecode execution by uploading malicious .class files through the database utilities. The flaw stems from insecure use of Java's reflection APIs without proper validation of loaded classes. **Exploitation Chain:** Attackers chain these vulnerabilities to achieve pre-authentication RCE. Huntress documented attacks where threat actors injected Base64-encoded payloads that decoded to reconnaissance commands (whoami, ver, tasklist). They then dropped Java .class files (Udydn.class, Moo97.class) into the PaperCut server library, executing OS-agnostic commands under SYSTEM privileges to profile systems and exfiltrate data. Post-exploitation cleanup included deletion of server.log files to erase forensic evidence. **Scale & Impact:** As of September 1, 2026, Shadowserver identified 800+ unpatched PaperCut servers exposed online, with concentrated exposure in the US (6,200 vulnerable instances) and Germany (5,100+). Organizations like universities, print shops, and government agencies face mailbox hijacking, ransomware deployment, and lateral network movement. Unlike previous 2023 PaperCut exploits linked to Clop and LockBit ransomware, this chain enables unauthenticated pre-access RCE, making it trivially weaponizable. **Patch Status:** PaperCut released three emergency patches between August 27-September 1, with Release 3 being the current recommended version. However, 47% of tracked PaperCut installations run v23 or older with no patch available, creating persistent risk.