Quick take: On August 31, 2026, CISA added two PaperCut NG/MF flaws — CVE-2026-81578 and CVE-2026-82078 — to the Known Exploited Vulnerabilities catalog. They chain into an unauthenticated configuration-change plus Java code-execution path on the PaperCut Application Server. Small businesses, schools, MSPs, and anyone still exposing a print-management console to the internet should treat this as an emergency patch-and-isolation job, not a routine Tuesday update.

PaperCut’s own bulletin, last updated September 2, 2026, says the company is investigating active exploitation, has confirmed customer incidents, and has now shipped Emergency Patch Release 3 after earlier emergency builds. CISA’s August 31 alert is shorter and blunter: these two CVEs are in KEV because there is evidence of exploitation in the wild. Federal civilian agencies have a September 14, 2026 due date under BOD 26-04. Private companies are not bound by that deadline, but they should not wait for it either.

What happened

Print-management software is unglamorous infrastructure. PaperCut NG and PaperCut MF sit on Windows, Linux, or macOS Application Servers, talk to print queues and multifunction devices, and expose a web admin console that IT teams use to manage quotas, accounting, scan workflows, and user cards. When that console is reachable from the public internet, it becomes a high-value, low-attention target.

That pattern is not new. PaperCut NG/MF was already a well-known initial-access surface after the 2023 remote-code-execution issues. This 2026 event is a different pair of bugs, but it hits the same operational blind spot: a server that looks like “just printing” while it actually runs a privileged Java application with access to identity data, file shares, and often domain-joined Windows hosts.

According to the PaperCut security bulletin dated 27 August 2026, the vendor disclosed two public CVEs:

• CVE-2026-81578 — authentication bypass / missing authentication for a critical function in the web management interface. Unauthenticated remote requests can trigger backend admin actions before access checks finish, which lets an attacker modify certain system configurations. PaperCut rates it 8.8 High on CVSS 4.0.
• CVE-2026-82078 — unsafe dynamic class loading in database connection utilities. Configurable driver names are instantiated without an allowlist. If an attacker can change those configuration parameters, they can execute arbitrary Java bytecode from the application classpath as the PaperCut server process. PaperCut rates it 9.4 Critical on CVSS 4.0.

CISA’s KEV entries make the operational point explicit: the two issues can be chained. CVE-2026-81578 is the unauthenticated configuration foothold. CVE-2026-82078 is the code-execution step that becomes much more dangerous once that foothold exists. The NVD record for CVE-2026-81578 also notes a Metasploit pull request, which is a practical signal that exploit tooling is moving from private incident response into public frameworks.

Why this matters for small businesses

Most small companies do not run MLflow clusters or Cisco firewall managers. Plenty of them do run a print server, a copier fleet, or an MSP-managed PaperCut box for offices, clinics, law firms, and schools. Those systems are often:

• left on an old major version because “printing still works”;
• exposed through port forwarding, a VPN exception, or a “temporary” firewall hole for remote admin;
• joined to Active Directory so card authentication and print accounting work;
• excluded from the same patch cadence as Windows, firewalls, and SaaS apps.

PaperCut’s September 2 field update is the sentence owners should not skip: there is a second wave of attacks against servers that are not fully patched and remain publicly available, and that wave appears to involve more sophisticated post-compromise behavior than the first days of the incident. CISA currently lists ransomware-campaign use as Unknown for both CVEs. Do not invent a ransomware brand here. Do treat a compromised print server as a possible beachhead into the rest of the office network.

If you already use CISA KEV as a patch filter, this belongs in the same queue as the other recent “forgotten infrastructure” additions we have covered, including the August 2026 KEV patch-priority roundup and the MLflow SSRF KEV warning. The product is different. The lesson is the same: internet-exposed admin planes get exploited first.

How the two bugs chain

You do not need a full exploit walkthrough to make a good decision. You do need the trust-boundary picture.

1. An unauthenticated attacker reaches the PaperCut web management interface over the network.
2. CVE-2026-81578 lets some administrative backend actions run before authentication finishes, so selected configuration can change without a valid admin session.
3. CVE-2026-82078 then abuses database-connector class loading. PaperCut instantiates JDBC driver classes from configurable names. Without an allowlist, that becomes a way to load attacker-controlled Java classes already planted on, or reachable from, the classpath.
4. Code then runs as the PaperCut server process. On Windows that is commonly pc-app.exe. From there, attackers can spawn shells, drop remote-access tools, and move toward domain reconnaissance.

That is why “we changed the admin password” is not a complete response. The first bug is about missing authentication on a function, not a stolen password. Restricting network access and applying the current emergency patch are the controls that actually shrink the attack surface.

Who is affected — and who is not

PaperCut’s bulletin applies to all versions of PaperCut NG and PaperCut MF. The CVE records describe affected MF/NG versions before the emergency-fixed lines in 24.x, 25.x, and 26.x. The vendor’s current download table, as of September 2, 2026, ships Emergency Patch Release 3 as:

• PaperCut MF/NG v26: 26.0.4-PO-4560 builds
• PaperCut MF/NG v25: 25.0.12-PO-4560 builds
• PaperCut MF/NG v24: 24.1.9-PO-4560 builds

Those are emergency builds, not the usual QA’d maintenance release. PaperCut says a maintenance release is in progress and that Release 3 supersedes earlier emergency patches. If you already installed Release 2, the vendor still wants Release 3. Customers on NG/MF 23 and earlier are told to upgrade to a current major version rather than wait for a backported emergency installer.

Also patch site servers and secondary/print servers, not only the primary Application Server. PaperCut says Mobility Print, Print Deploy server components, and client software (User Client, Print Deploy client, Mobility Print installer) are not affected. The bulletin also says this incident does not apply to PaperCut Hive or PaperCut Pocket.

If you are not sure whether you even have PaperCut, ask a more basic inventory question: who manages printing, copiers, and scan-to-email? MSPs, school IT, and copier vendors often install NG/MF without the business owner ever hearing the product name.

Do this today

1. Find every PaperCut NG/MF Application Server. Check internal IT docs, copier-vendor contracts, MSP inventories, and any host listening on PaperCut’s admin web ports. Do not assume “we only have cloud printing.”
2. Cut public internet access immediately. PaperCut’s first required action is to restrict web access to trusted IPs if the Application Server is reachable from the public internet. Use firewall rules or network ACLs. Do this even if you have seen no alerts. Mobility Print ports are a separate architecture and, per the vendor FAQ, do not need to be closed for this bulletin.
3. Install Emergency Patch Release 3 from the live bulletin. Follow PaperCut’s standard upgrade procedure. Verify checksums from the vendor page rather than copying hashes from a third-party recap, because emergency builds are still moving.
4. Patch site servers and secondary print servers too. A hardened primary with an unpatched site server is an incomplete job.
5. Look for compromise before you declare victory. CISA’s BOD 26-04 language asks federal agencies to consider whether threat actors were already inside before the patch. That is good advice for everyone. A patched but previously internet-facing server can still have a dropped remote-access tool.
6. If you suspect compromise, rebuild. PaperCut recommends securing current backups, wiping and rebuilding the Application Server, and restoring a clean backup from before suspicious behavior. Then run your normal incident process: isolate, rotate credentials, check identity systems, and review other hosts the print server could reach.

Rare configuration note: if you use an external database for card/ID number lookups, PaperCut now requires security.card-number-lookup.enabled=Y in server/security.properties plus an Application Server restart. Most customers will not need that key. If card lookups break after patching and you still use the legacy jTDS SQL Server driver, the vendor recommends moving to the current Microsoft SQL JDBC driver.

Indicators worth checking

PaperCut is still investigating, and it warns that missing indicators do not prove a host is clean. The currently published clues are still useful for a first pass:

• Endpoint, IDS, or EDR alerts involving the PaperCut Application Server, especially suspicious child activity from pc-app.exe / pc-app.
• Missing, truncated, or deleted server.log files.
• Log strings such as ERROR No suitable driver found for jdbc:no:x, ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST, DB URL: jdbc:derby:memory:pwn;create=true, or a DB Driver with a 5-character random name.
• Unexpected files under the install tree, including server\lib\<5-char-name>.class and server\data\content\<5-char-name>.cmd / .out. Attackers may delete these later.
• Observed post-exploitation: pc-app launching cmd.exe, running whoami & ver, domain reconnaissance (nltest /dclist:, quser), then dropping remote-access tooling.
• A Windows service named Remote Access Service running SimpleService.exe from C:\ProgramData\JWrapper-Remote Access\..., and unexpected AnyDesk under C:\ProgramData.

PaperCut published a defanged command timeline that includes downloads from sendit[.]sh and download[.]anydesk[.]com. Use those as detection/blocklist inputs, not as proof that every victim sees the same payload. The September 2 field note says later waves look more sophisticated than the first observed sequence.

This is also a good moment to reconnect print-server risk to the rest of your stack. A compromised Application Server can steal credentials, abuse saved scan destinations, and stage ransomware. Pair this incident with a current ransomware prevention checklist, the CISA KEV prioritization explainer, and practical controls from the CI/CD security checklist if your MSP or internal IT uses the same jump hosts for print servers and build systems.

A 60-minute owner checklist

1. Ask: do we, our copier vendor, or our MSP run PaperCut NG or MF?
2. If yes, is the admin web interface reachable from outside the office, from guest Wi-Fi, or from a broad VLAN?
3. Screenshot the current version/build from the admin UI or installer, then apply Release 3 from the vendor bulletin.
4. Confirm site servers and secondary print servers match the patched build.
5. Search EDR and Windows event logs for pc-app.exe spawning cmd.exe or PowerShell.
6. Search for SimpleHelp/AnyDesk artifacts in C:\ProgramData that nobody authorized.
7. If the server was public and unpatched during late August, treat it as potentially compromised until logs and a rebuild say otherwise.
8. Remove the temporary firewall exception that made remote admin “easier.” Put admin access behind VPN or another identity-aware path.
9. Add PaperCut to the same KEV watch list you already use for firewalls, VPN concentrators, and backup consoles.
10. Tell the people who actually reboot copiers that print accounting going down for a patch window is cheaper than a domain incident.

How this fits the rest of the 2026 KEV pattern

CISA keeps adding products that sit off to the side of “core IT”: print servers, ML tracking UIs, firewall managers, MSP RMM platforms. The Cisco FMC KEV write-up and the MLflow warning were about management/control planes. PaperCut is the office version of the same class. If your patch meeting only covers Microsoft, browsers, and the firewall, you will keep discovering KEV items after attackers already have a foothold.

Use KEV as a forcing function, not as a complete vulnerability program. BOD 26-04 is written for federal agencies, but the useful private-sector translation is simple: prioritize known-exploited, internet-exposed, total-control bugs ahead of a long CVSS-sorted backlog. Then check whether the box was already hit. For a broader small-business view of that process, start with our KEV catalog explainer and keep the August roundup nearby when you triage the rest of this month’s catalog.

FAQ

Is this the same as the 2023 PaperCut attacks?

No. The 2023 issues were a different set of CVEs. The operational rhyme is that PaperCut Application Servers were internet-exposed, privileged, and slow to patch. This 2026 chain is CVE-2026-81578 plus CVE-2026-82078.

Does CISA say ransomware groups are using these two CVEs?

Not in the current KEV fields. Both entries list known ransomware campaign use as Unknown. PaperCut has confirmed customer incidents and a second attack wave against unpatched public servers. Investigate as if ransomware could follow, without claiming a specific crew.

We only use PaperCut on the internal LAN. Are we safe?

Safer than an internet-facing console, not automatically safe. Patch anyway. Restrict admin access to IT jump hosts. Unauthenticated network bugs become much more useful after one phishing click or one compromised VPN account. See our phishing prevention checklist for remote teams if remote admin is the reason that console was ever published.

Do we need to update Hive, Pocket, or Mobility Print?

PaperCut says Hive/Pocket are out of scope, and Mobility Print / Print Deploy / user clients do not need an update for this bulletin. NG/MF Application Servers, site servers, and secondary print servers do.

We installed the first emergency patch. Are we done?

No. Release 3 supersedes earlier emergency builds, restores SAML and legacy SQL-driver regressions from earlier patches, and adds extra hardening against attack chains observed in the wild. Install Release 3, then keep watching the live vendor bulletin for the forthcoming maintenance release.

What should we tell leadership?

A widely deployed print-management server has a known-exploited, chainable unauthenticated path to code execution. The vendor has confirmed incidents. The fix is isolate the admin interface, install the current emergency patch, and inspect for leftover remote-access tools. The cost of a print outage is finite. The cost of a domain-joined print server running attacker code is not.

Final verdict

This is not a niche developer CVE. It is a print-server emergency with a CISA KEV stamp, a September 14 federal due date, and a vendor bulletin that is still in an active incident state. If you own or manage PaperCut NG/MF, assume internet exposure is the default failure mode, apply Emergency Patch Release 3 from the official bulletin, patch every related server role, and hunt for SimpleHelp/AnyDesk-style leftovers before you move on. Then put print-management consoles on the same KEV watch list as firewalls and backup servers so the next forgotten admin plane is not a surprise.