🔴 CVE-2026-81578

CVE-2026-81578 is an unauthenticated improper access control / authentication bypass vulnerability in the web management interface of PaperCut MF/NG. Remote attackers can trigger administrative backend actions before access validation completes, modifying server configurations. It is actively exploited in the wild, listed in CISA KEV, and is frequently chained with CVE-2026-82078 to achieve pre-authentication RCE on the PaperCut Application Server.

← Back to Overview
HIGH_RISK
Risk Level
8.8
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
MEDIUM
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-28

Added to CISA KEV: 2026-08-31 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-81578 is a critical improper access control vulnerability (CWE-306) affecting the web management interface of PaperCut MF and PaperCut NG print management software [5][8]. The flaw allows unauthenticated remote requests to trigger backend administrative actions before access validation checks are completed, enabling attackers to modify server configurations [7][10]. This vulnerability is highly significant because, when chained with CVE-2026-82078, it facilitates pre-authentication remote code execution (RCE) on the PaperCut Application Server [3].

Exploitation

  • Active Exploitation: The vulnerability is actively exploited in the wild, with confirmed incidents reported by PaperCut and observed attacks targeting the education sector in the U.S. and Europe [4][6].
  • Attack Path: Attackers typically chain this vulnerability with CVE-2026-82078 by sending specific POST requests to bypass authentication, reconfigure database connectors, execute arbitrary Groovy code, and then revert the configuration to cover their tracks [1].
  • Availability: Technical details and proof-of-concept research are publicly available, and the vulnerability is known to be a frequent attack vector for malicious actors [1][9].
  • Prerequisites: Exploitation is remote and does not require local access, authentication, or user interaction [5].

Affected Products & Patches

  • Affected Versions: The vulnerability impacts all versions of PaperCut NG and PaperCut MF [3].
  • Patch Availability: PaperCut has released security maintenance releases that replace all initial emergency patches; customers are urged to download and install the latest available versions from the official PaperCut website [2].
  • Mitigations: There are no recommended workarounds other than applying the official security maintenance releases, as the flaw resides in the core authentication handling of the application server [2].

Impact

  • Capability: Successful exploitation grants an unauthenticated attacker the ability to reconfigure the system and, when chained, achieve remote code execution, which allows for full control over the affected Application Server [1][3].
  • Business Risk: Internet-facing PaperCut deployments are at extreme risk of compromise, including the potential for credential theft, lateral movement within the network, and the deployment of ransomware, as evidenced by its active targeting in the education sector [4].

Sources

  1. PaperCut NG/MF Zero-Day: CVE-2026-81578, CVE-2026-82078 (Active ...

    We saw attackers successfully chain both CVE-2026-81578 and CVE-2026-82078 to gain Remote Code Execution on our PaperCut sensors. Exploitation followed a sequence of POST requests designed to bypass authentication, reconfigure the database connector to execute Groovy code, trigger the vulnerability,…

  2. URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)

    URGENT Security Advisory Status 10 Sep 2026, 2:00pm (AEST): Security maintenance releases published. These replace all emergency patches. Download links below. Read the Behind the Scenes blog post for the backstory. PaperCut Software security response team is investigating active exploitation of a v…

  3. PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE ...

    PaperCut released an Urgent Security Advisory to address two actively exploited vulnerabilities, tracked as CVE-2026-82078 & CVE-2026-81578, impacting all versions of PaperCut NG and PaperCut MF. When chained together, these vulnerabilities can enable pre-authentication remote code execution in the…

  4. CVE-2026-81578 & CVE-2026-82078: PaperCut Exploitation in Education ...

    Attackers are actively exploiting two new PaperCut flaws (CVE-2026-81578, CVE-2026-82078) against U.S. and European schools to steal credentials and gain privileged access. Patch and hunt now.

  5. CVE-2026-81578 · PaperCut · CVSS 9.5 · CISA KEV · CVE Brief Analyst Report

    CVE-2026-81578 is a missing-authentication flaw (CWE-306) in the web management interface of PaperCut NG and PaperCut MF, the print-management platform. An unauthenticated remote request reaches an administrative action before the access check completes, so an attacker with no credentials can rewrit…

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed