Attackers moved from a PaperCut Application Server to remote-access tooling in about 27 minutes in one sequence the vendor published on August 30. The activity began with host discovery and progressed through a staged executable, a LocalSystem SimpleHelp service, and an AnyDesk download. PaperCut says it is investigating active exploitation of PaperCut NG and MF and is aware of confirmed customer incidents.
The new artifacts sharpen a response that began with a broad warning on August 27. PaperCut treats every version of NG and MF as potentially affected. It has issued Emergency Patch Release 2 for the supported v24, v25, and v26 branches and recommends that customers install Release 2 even if they applied the original emergency patch.
Configuration opens code execution
The attack joins two vulnerabilities. CVE-2026-81578 is an access-control failure in the web management interface. Under specific conditions, an unauthenticated remote request can reach administrative functions before validation finishes and change certain system configuration.
That control feeds CVE-2026-82078, an unsafe dynamic class-loading flaw in PaperCut’s database utilities. The application accepts a configured database-driver class without checking it against an allowlist. An attacker who controls the relevant configuration can make the server instantiate Java bytecode already placed on its classpath, under the security context of the PaperCut process.
Huntress reproduced the complete pre-authentication chain against a stock PaperCut NG 25.0.11.75758 installation. The firm also found exploitation evidence in two customer environments. As Huntress put it, “Huntress has found evidence of exploitation in two customer environments.” That count establishes real use, while PaperCut has not disclosed an overall incident total.
Figure details
An unauthenticated web request reaches a PaperCut administrative action before access validation completes. The attacker changes database-related configuration, points PaperCut at a five-character Java class under the server library directory, and triggers unsafe driver loading. Code then runs inside the PaperCut Application Server process. The observed post-exploitation branch shows host discovery, a staged executable, a LocalSystem SimpleHelp service, and an AnyDesk download.
Incident artifacts trace progression
Start with process ancestry. PaperCut names suspicious children of pc-app.exe on Windows and pc-app on other systems. Both the vendor and Huntress observed whoami & ver; PaperCut’s longer timeline adds tasklist, nltest /dclist:, quser & dir c:\users, and PowerShell downloads. A shell, discovery utility, or script interpreter launched from the print application deserves immediate scrutiny.
Preserve server.log and its metadata before searching. The vendor says the file may be missing, unexpectedly truncated, or deleted. Search for every published string:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CASTDB URL: jdbc:derby:memory:pwn;create=trueDatabase error looking up cardID: VALUES CAST(X'cafebabeDatabase error looking up cardID: VALUES CAST('DB URL: jdbc:no:x DB Driver: <5-char random name>
Correlate those entries with the variable dropped-file patterns <install>\server\lib\<5-char-name>.class, <install>\server\data\content\<5-char-name>.cmd, and <install>\server\data\content\<5-char-name>.out. PaperCut cautions that attackers may clean up these files as activity progresses, so their absence does not clear a host.
The observed sequence staged C:\ProgramData\ace.exe, then installed SimpleHelp as Remote Access Service running as LocalSystem from C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe. It later wrote AnyDesk to C:\ProgramData\AnyDesk.exe. The operator abused the legitimate shared services sendit.sh and download.anydesk.com; those hostnames are investigation pivots in this incident, rather than proof that either service is malicious. Nulltap is omitting the complete operational download paths.
Exposure defines the response
Internet reachability drives urgency. PaperCut tells customers with a public Application Server to restrict its web interfaces to trusted IP addresses immediately, even when they have seen no suspicious activity. A reverse proxy, firewall, or network access control should enforce that boundary. An application login page still reachable from an untrusted address fails the test.
The known scale remains bounded. PaperCut confirms customer incidents across a product family whose full version history is potentially affected, but gives no customer count. Huntress saw two environments. In those two cases, Huntress had not observed secondary malware, more command-and-control traffic, or added persistence at publication; PaperCut’s later timeline documents remote-access tooling in other observed activity, so that narrower result cannot be applied to every incident.
The products’ trusted position raises the consequence. A print-management server often has broad network reach, directory integration, and a service account that administrators may overlook. The exploit itself runs in the existing PaperCut security context. The sources do not identify an actor, an initial victim population, or a single consistent post-compromise pattern.
Patch and preserve evidence
Install PaperCut NG or MF Emergency Patch Release 2 for the deployed v24, v25, or v26 branch. Release 2 is the current recommended state; the original emergency patch is superseded because the second release adds hardening developed with PaperCut, Huntress, and watchTowr. Customers using an external database for Card/ID lookups should also follow the advisory’s security.properties guidance and perform its post-install checks.
Treat a previously public server as an investigation target before returning it to service. Preserve the full server/logs directory, current and nondefault configuration, endpoint process trees, reverse-proxy and firewall records, DNS and flow telemetry, recent services, scheduled tasks, autoruns, and file-creation history. Correlate the first PaperCut configuration or log anomaly with child execution from pc-app.exe, then look forward for the published file paths and remote-access service.
Use two verification tests. From an untrusted network, request each PaperCut web interface; the expected result is a network-layer denial with no application response. On the server, confirm the Release 2 installer for the correct major branch is present, then search preserved evidence for server.log, ERROR No suitable driver found for jdbc:no:x, DB URL: jdbc:derby:memory:pwn;create=true, <install>\server\lib\<5-char-name>.class, whoami & ver, and Remote Access Service. The expected result for a clean, rebuilt system is no unexplained match and no child shell from the PaperCut process.
Access limits the blast radius
PaperCut’s emergency patch closes the known chain, while network restriction removes the public route that made exploitation practical. Neither measure reconstructs activity that occurred before deployment, which is why evidence preservation belongs beside patching. A print server should return to service only after its access boundary and host history tell the same defensible story.