CVE-2026-81578: PaperCut NG/MF authentication bypass in web admin interface

Exploited in the wild High 8.8 EPSS 84.7%

In PaperCut NG and MF, unauthenticated remote requests to administrative functions of the web management interface can trigger backend actions before access checks complete, letting an attacker change certain system configuration (CVSS 4.0: 8.8). Observed attacks combine it with CVE-2026-82078 to run code on the Application Server. PaperCut confirmed active exploitation and customer incidents, first shipped emergency patches and then, on 10 September 2026, maintenance releases 26.0.5, 25.0.13 and 24.1.10; CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on 2026-08-31.

CVE-2026-81578CVE identifier
8.8CVSS 4.0 base score (high)
2026-08-31added to CISA's exploited list (US federal deadline 2026-09-14)
84.7%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2026-08-28published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
The installer restarts the Application Server; wait for any background database upgrade to finish before using the admin UI. Upgrade Site Servers to the same version at the same time.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

PaperCut NG/MF before 24.1.10
PaperCut NG/MF 25.0.0 before 25.0.13
PaperCut NG/MF 26.0.0 before 26.0.5
PaperCut NG/MF 23.x and earlier (no fix; upgrade to a supported line)

Fixed in:

PaperCut NG/MF 26.0.5 (MF build 76602, NG build 76603)
PaperCut NG/MF 25.0.13 (MF build 76604, NG build 76605)
PaperCut NG/MF 24.1.10 (MF build 76610, NG build 76611)

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Built from source

# Linux Application Server: install the new release 'over the top' as the papercut user
# (stop PaperCut services and back up the install directory and database first)
su - papercut
wget <download URL for pcng-/pcmf-setup 26.0.5, 25.0.13 or 24.1.10 linux .sh>
sha256sum pc*-setup-*-linux-*.sh   # compare with checksum in the PaperCut bulletin
sh pcmf-setup-*-linux-*.sh          # pcng-setup-... for PaperCut NG; enter root password when asked

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

If the Application Server is reachable from the internet, immediately restrict access to its web interfaces (TCP 9191/9192 etc.) to trusted IP addresses with firewall rules or network ACLs (PaperCut). Mobility Print ports do not need to be restricted.
Versions 23 and earlier get no patch: upgrade to 24, 25 or 26 and keep the web interface restricted until then.

Look for signs of exploitation

server.log entries: 'No suitable driver found for jdbc:no:x', 'DB URL: jdbc:derby:memory:pwn;create=true', 'DB URL: jdbc:no:x DB Driver: <5-char random name>', 'Database error looking up cardID: VALUES CAST(X'cafebabe' or 'VALUES CAST('.
Missing, truncated or deleted server.log files.
Unexpected files server/lib/<5-char-name>.class and server/data/content/<5-char-name>.cmd / .out under the PaperCut install directory (may be cleaned up by the attacker).
The pc-app process spawning shells and running reconnaissance (whoami, ver, tasklist, nltest), downloads from sendit.sh, and installation of SimpleHelp ('Remote Access Service') or AnyDesk remote-access tools (observed on Windows servers).

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81578

Related vulnerabilities

CVE-2026-82078

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.