PaperCut NG/MF Attacks: What Emergency Release 3 Changes

Incident summary

PaperCut Software published Emergency Patch Release 3 for PaperCut NG and PaperCut MF at 6:22 p.m. AEST on September 1, 2026. The cumulative emergency patch fixes SAML and legacy Microsoft SQL Server regressions introduced around Release 2 and adds hardening against additional attack paths that PaperCut says it has observed being exploited in the wild.

PaperCut recommends Release 3 for every internet-facing Application Server, including systems that already received an earlier emergency patch. This makes the change more than a file replacement: teams should combine exposure reduction, the patch rollout, compromise review, and production checks for authentication, card lookup, and distributed servers.

Release 3 scope

Release 3 is available for PaperCut NG and MF v24, v25, and v26 on Windows, Linux, and macOS. It supersedes Releases 1 and 2, so administrators do not need to install the earlier emergency packages first. Each server should be matched to the product, major version, operating system, build number, and SHA-256 checksum listed in the vendor bulletin.

The first regression addressed in Release 3 affects SAML sign-in flows. The second restores support for environments that use legacy Microsoft SQL Server drivers for external Card/ID number lookup. PaperCut also added hardening for attack vectors seen in real-world exploitation while preserving the Card/ID configuration guidance introduced with Release 2.

This remains an emergency patch rather than a normal maintenance release that has completed PaperCut’s standard quality-assurance process. The vendor is preparing a regular release, but it directs customers with public-facing Application Servers to install Release 3 as soon as possible when they cannot fully isolate those interfaces. Record the running build and package checksum after deployment instead of relying only on an installer success message.

How the two flaws connect

CVE-2026-81578 is an access-control flaw in the PaperCut NG and MF web administration interface. Under specific conditions, an unauthenticated remote request can trigger backend actions before access validation finishes, allowing some system configuration values to be changed. The issue carries a CVSS 4.0 score of 8.8 and does not require user interaction.

CVE-2026-82078 affects dynamic class loading in database connection utilities. When an attacker can manipulate the relevant configuration, PaperCut may instantiate a driver class without checking it against an approved allowlist. Java bytecode on the application classpath can then execute in the security context of the PaperCut server process. Its CVSS 4.0 score is 9.4.

Treating the CVEs as a connected path gives operators a clearer investigation model. A request reaches the administrative web interface, crosses the authentication boundary, changes backend configuration, and uses that change to influence class loading before post-compromise activity appears from the server process. Release 3’s additional hardening is intended to close more of these composable paths.

Exposure and affected deployments

A server does not need a public IP address to be reachable from the internet. Reverse proxies, load balancers, NAT rules, cloud security groups, maintenance VPNs, and DNS records may all lead to the Application Server web interface. PaperCut’s immediate mitigation is to restrict those web interfaces to trusted addresses such as an internal management network or an approved VPN egress.

Distributed organizations often run different NG or MF versions and operating systems across headquarters, branches, campuses, and data centers. The inventory should include product, major version, operating system, exposure path, Primary, Site, or Secondary Server role, SAML usage, external Card/ID lookup, and the SQL driver in use. A successful patch on one server is not evidence that the whole deployment has been covered.

PaperCut Hive, PaperCut Pocket, Mobility Print, Print Deploy server components, and client software are outside the scope of this NG/MF bulletin. In an affected NG or MF deployment, however, Site Servers and Secondary or print servers should be brought to a patched version along with the Primary Application Server. The restart plan should reflect the real dependency order among these components.

Compromise-review evidence

A useful compromise review aligns web requests, authentication, process, file, and network records on a common timeline. PaperCut calls out suspicious post-exploitation activity from pc-app.exe and server.log files that are missing, truncated, or deleted. A signed executable should still be examined for unusual parent-child relationships, command lines, service accounts, new services, and outbound connections.

The vendor bulletin lists server.log strings and filesystem or service artifacts observed during the response. Examples include `jdbc:derby:memory:pwn;create=true`, `VALUES CAST(X'cafebabe`, `DB URL: jdbc:no:x`, randomly named database driver values, a `Remote Access Service` running `SimpleService.exe`, and unexpected AnyDesk installations. Preserve original logs and metadata before isolating or rebuilding a server where these indicators appear.

PaperCut advises organizations that suspect compromise to protect current backups, wipe and rebuild the Application Server, and restore from a known-clean backup created before the suspicious activity. Exposed credentials and secrets should be replaced before reconnection, while trusted-IP restrictions stay in place. Restarting the server or installing the patch over a potentially compromised system does not remove persistence or configuration changes.

Priority checks

1. Restrict the Application Server web interface to trusted IP addresses at firewalls, proxies, NAT devices, and cloud security groups.
2. Map every NG and MF v24, v25, and v26 server to its role, operating system, Release 3 build, package, and SHA-256 checksum.
3. Bring Primary, Site, and Secondary or print servers to patched versions and verify the build actually running on each host.
4. Test SAML sign-in, external Card/ID lookup, the Microsoft SQL Server driver, print queues, and directory integration through real workflows.
5. Review pc-app.exe, server.log, web requests, authentication, services, remote-access software, and network records on one timeline.
6. Move systems with suspicious artifacts into evidence preservation, clean rebuild, restore, and credential-rotation procedures.

Completion should be based on both security and service evidence. Confirm that untrusted sources can no longer reach the management interface, Release 3 is the active build, SAML and card lookup work, Site Servers and queues reconnect, and EDR and log collection resume. If a regression appears, keep access restricted and work through the integration problem with PaperCut support instead of returning the server to a vulnerable build.

Operational impact

PaperCut often concentrates authentication, directory integration, print queues, and multifunction-device workflows in one Application Server. A compromise can therefore move beyond a print service into administrative credentials and dependent business operations. Because Release 3 is recommended even for previously patched systems, organizations need to reopen assets they had already marked complete.

Prioritize public-facing Application Servers, systems still on Release 1 or 2, deployments that rely on SAML or legacy SQL drivers, and servers with short server.log retention. Combining exposure, server role, identity integration, and evidence retention produces a more reliable rollout order than sorting on product version alone.

Official sources

PaperCut Software urgent security bulletin

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

CISA Known Exploited Vulnerabilities Catalog

https://www.cisa.gov/known-exploited-vulnerabilities-catalog