Attackers moved from a PaperCut Application Server to remote-access tooling in about 27 minutes in one sequence the vendor published on August 30. The activity began with host discovery and progressed through a staged executable, a LocalSystem SimpleHelp service, and an AnyDesk download. PaperCut says it is investigating active exploitation of PaperCut NG and MF and is aware of confirmed customer incidents.
The new artifacts sharpen a response that began with a broad warning on August 27. PaperCut treats every version of NG and MF as potentially affected. It recommends Emergency Patch Release 3 for internet-facing servers on the supported v24, v25, and v26 branches, including systems that already received an earlier emergency release.
CISA’s catalog records an August 31 listing date for CVE-2026-81578 and CVE-2026-82078. Federal civilian agencies have a September 14 remediation deadline under the applicable exposure-based guidance.
Configuration opens code execution
The attack joins two vulnerabilities. CVE-2026-81578 is an access-control failure in the web management interface. Under specific conditions, an unauthenticated remote request can reach administrative functions before validation finishes and change certain system configuration.
That control feeds CVE-2026-82078, an unsafe dynamic class-loading flaw in PaperCut’s database utilities. The application accepts a configured database-driver class without checking it against an allowlist. An attacker who controls the relevant configuration can make the server instantiate Java bytecode already placed on its classpath, under the security context of the PaperCut process.
Huntress reproduced the complete pre-authentication chain against a stock PaperCut NG 25.0.11.75758 installation. The firm also found exploitation evidence in two customer environments. As Huntress put it, “Huntress has found evidence of exploitation in two customer environments.” That count establishes real use, while PaperCut has not disclosed an overall incident total.
Figure details
An unauthenticated web request reaches a PaperCut administrative action before access validation completes. The attacker changes database-related configuration, points PaperCut at a five-character Java class under the server library directory, and triggers unsafe driver loading. Code then runs inside the PaperCut Application Server process. The observed post-exploitation branch shows host discovery, a staged executable, a LocalSystem SimpleHelp service, and an AnyDesk download.
Incident artifacts trace progression
Start with process ancestry. PaperCut names suspicious children of pc-app.exe on Windows and pc-app on other systems. Both the vendor and Huntress observed whoami & ver; PaperCut’s longer timeline adds tasklist, nltest /dclist:, quser & dir c:\users, and PowerShell downloads. A shell, discovery utility, or script interpreter launched from the print application deserves immediate scrutiny.
Preserve server.log and its metadata before searching. The vendor says the file may be missing, unexpectedly truncated, or deleted. Search for every published string:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CASTDB URL: jdbc:derby:memory:pwn;create=trueDatabase error looking up cardID: VALUES CAST(X'cafebabeDatabase error looking up cardID: VALUES CAST('DB URL: jdbc:no:x DB Driver: <5-char random name>
Correlate those entries with the variable dropped-file patterns <install>\server\lib\<5-char-name>.class, <install>\server\data\content\<5-char-name>.cmd, and <install>\server\data\content\<5-char-name>.out. PaperCut cautions that attackers may clean up these files as activity progresses, so their absence does not clear a host.
The observed sequence staged C:\ProgramData\ace.exe, then installed SimpleHelp as Remote Access Service running as LocalSystem from C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe. It later wrote AnyDesk to C:\ProgramData\AnyDesk.exe. The operator abused the legitimate shared services sendit.sh and download.anydesk.com; those hostnames are investigation pivots in this incident, rather than proof that either service is malicious. Nulltap is omitting the complete operational download paths.
Exposure defines the response
Internet reachability drives urgency. PaperCut tells customers with a public Application Server to restrict its web interfaces to trusted IP addresses immediately, even when they have seen no suspicious activity. A reverse proxy, firewall, or network access control should enforce that boundary. An application login page still reachable from an untrusted address fails the test.
The known scale remains bounded. PaperCut confirms customer incidents across a product family whose full version history is potentially affected, but gives no customer count. Huntress saw two environments. In those two cases, Huntress had not observed secondary malware, more command-and-control traffic, or added persistence at publication; PaperCut’s later timeline documents remote-access tooling in other observed activity, so that narrower result cannot be applied to every incident.
The products’ trusted position raises the consequence. A print-management server often has broad network reach, directory integration, and a service account that administrators may overlook. The exploit itself runs in the existing PaperCut security context. The sources do not identify an actor, an initial victim population, or a single consistent post-compromise pattern.
Patch and preserve evidence
Install PaperCut NG or MF Emergency Patch Release 3 for the deployed v24, v25, or v26 branch on the Application Server, every Site Server, and every secondary or print server. Release 3 accumulates the earlier emergency releases, fixes SAML and legacy Microsoft SQL Server regressions, and adds hardening against additional attack vectors PaperCut says it has observed being exploited in the wild. The listed Release 3 builds are NG 26.0.4 build 76530, 25.0.12 build 76533, and 24.1.9 build 76535, and MF 26.0.4 build 76531, 25.0.12 build 76532, and 24.1.9 build 76534. PaperCut says Mobility Print and Print Deploy server components, the User Client, Print Deploy client, and Mobility Print installer are unaffected and do not need this update.
Only deployments that require external database Card/ID lookup should add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server. The setting re-enables that optional feature after patching; it is not a security mitigation. PaperCut says the default N state silently ignores external lookup calls even when the Admin UI still shows the feature as configured.
Federal civilian agencies should record the applicable exposure classification and complete the vendor-directed remediation by CISA’s September 14 deadline. Other operators should use the confirmed exploitation as a reason to prioritize exposed servers now.
Treat a previously public server as an investigation target before returning it to service. Preserve the full server/logs directory, current and nondefault configuration, endpoint process trees, reverse-proxy and firewall records, DNS and flow telemetry, recent services, scheduled tasks, autoruns, and file-creation history. Correlate the first PaperCut configuration or log anomaly with child execution from pc-app.exe, then look forward for the published file paths and remote-access service.
For suspected compromise, PaperCut recommends securing current backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. The vendor says it cannot assess the full scope inside an individual customer environment, so incident-response procedures still need to cover the surrounding systems and credentials.
Use two verification tests. From an untrusted network, request each PaperCut web interface; the expected result is a network-layer denial with no application response. On the server, confirm the installed build matches PaperCut’s Release 3 build for the product and major branch, then search preserved evidence for server.log, ERROR No suitable driver found for jdbc:no:x, DB URL: jdbc:derby:memory:pwn;create=true, <install>\server\lib\<5-char-name>.class, whoami & ver, and Remote Access Service. The expected result for a clean, rebuilt system is no unexplained match and no child shell from the PaperCut process.
Access limits the blast radius
PaperCut’s emergency patch closes the known chain, while network restriction removes the public route that made exploitation practical. Neither measure reconstructs activity that occurred before deployment, which is why evidence preservation belongs beside patching. A print server should return to service only after its access boundary and host history tell the same defensible story.