Which PaperCut build closes the attack chain that has been exploited since August? Only three answers are correct: 26.0.5, 25.0.13 and 24.1.10. PaperCut published those on September 10, two weeks and three emergency patch releases after the first fix went out. Every build in between leaves at least one link of the chain open, and a change ticket that reads "patched PaperCut, August 28" is almost certainly describing one of those builds.
watchTowr Labs published the full account on October 9. It reads as four reported issues against a product that was already under active exploitation. Two of the four defeated patches PaperCut had shipped days earlier. One defeated the fix for a bypass.
Whether this one is yours
This affects you if you run PaperCut NG or PaperCut MF on a server you own. PaperCut Hive and PaperCut Pocket are out of scope, so if your print management is the cloud product, you can stop here. For everyone else the vendor's position in its August 27 bulletin is that every self-hosted install needs the upgrade, internet-facing or not.
Two facts set your urgency. If the Application Server's web interface on port 9191 answers from the internet, work the server as a suspected compromise before you work it as a patch; PaperCut states that publicly reachable unpatched servers continue to be targeted and that it has confirmed customer incidents. If the interface is reachable only from inside, you have room to plan, and you still have the same job. The authentication bypass needs network reach to the web interface and nothing else, which describes every workstation on your LAN.
Running version 23 or earlier puts you in the worst position. PaperCut shipped no patch for those branches. Upgrading to 24, 25 or 26 is the only available fix, and that is a project rather than a maintenance window.
One more group should keep reading even after upgrading: anyone whose remediation stopped at an emergency patch. The last link in the chain, CVE-2026-82077, never reached the Known Exploited Vulnerabilities catalog, so no federal due date has been chasing it and most trackers never raised it.
Four reports in five days, three of them against a patch
The sequence matters more than any single identifier, so here it is with dates, taken from the watchTowr timeline and the vendor's own dated updates.
- August 27. PaperCut publishes the bulletin. Exploitation of 26.0.3 is already happening. No CVEs yet, no patch. watchTowr diffs 26.0.4, reproduces the issues that become
CVE-2026-81578andCVE-2026-82078, and reports WT-2026-0141, a bypass of the 82078 fix. - August 28. watchTowr reports WT-2026-0142, a bypass of the 81578 authentication fix. Chained with 0141 it restores unauthenticated code execution against 26.0.4. PaperCut ships 26.0.4-PO build 76508 to close both. watchTowr then reports WT-2026-0143, which bypasses the fix for 0142.
- August 31. CISA adds
CVE-2026-81578andCVE-2026-82078to the Known Exploited Vulnerabilities catalog with a September 14 due date. watchTowr reports WT-2026-0144, a separate command-execution path in the Scan-to-Fax connector. - September 1. PaperCut ships 26.0.4-PO build 76530 for WT-2026-0143, as Emergency Patch Release 3. The same release repairs regressions it had introduced in SAML login and in legacy SQL Server card lookups.
- September 10. The maintenance releases arrive: 26.0.5 build 76603, 25.0.13 build 76605 and 24.1.10 build 76611 for NG, with matching MF builds. These close WT-2026-0144, now CVE-2026-82077, and they replace every emergency patch.
Read that list as an operator rather than as a reader of advisories. A team that patched on August 27 took build 26.0.4 and was exploitable the next day. A team that patched on August 28 took build 76508 and was exploitable by a bypass reported the same afternoon. A team that patched on September 1 took build 76530 and still carried the fax connector flaw. Only the September 10 releases answer all four reports, and PaperCut says plainly that they supersede Releases 1 through 3.
How the chain reaches code execution
The two KEV entries are separately unremarkable and jointly fatal. CVE-2026-81578 is an access-control failure in the web management interface, rated CVSS 4.0 at 8.8, which lets unauthenticated requests reach administrative functions and change configuration. CVE-2026-82078 is unsafe dynamic class loading in the database connection utilities, rated 9.4: PaperCut instantiates a JDBC driver class from a configurable driver name with no allowlist, so whoever controls that configuration value controls which Java bytecode on the classpath gets executed as the server process.
Change the driver name, then make the server use it. That is the whole chain, and the first CVE supplies the write access the second one needs.
The authentication side is the more interesting engineering. PaperCut's admin pages run on Apache Tapestry, and the framework takes a service parameter on /app that can name a page and a sub-page. Authorization lives in BasePaperCutPage.pageValidate, and watchTowr found that it validates only the root page in that chain. The Home page does not extend BasePaperCutPage, so a request shaped like service=direct/1/Home/SetupAdmin/$Form enters through a page with no check and lands on a setup-wizard form that was supposed to be gated. The setup pages' own guard in BaseSetupPage.pageValidate never runs, which means the system.setup-completed flag never gets consulted. The reachable forms include SetupAdmin, SetupOrgType, SetupUserSource and SetupVerify.
The fourth issue is independent of all that. FaxProviderManagerImpl.sendFaxJob accepts a ScanFaxJob whose providerConnector value goes unvalidated into getAbsoluteBinaryPath, which appends it to the fax connector directory. Relative traversal in that value picks the binary, and the argument template comes from the system.scan.fax.send.command-args config key, which an administrator can edit in the Config Editor. NVD rates it 7.3 and classifies it as both CWE-22 and CWE-78, because it is a path traversal that terminates in command execution.
The same door, three years apart
PaperCut's setup wizard has been the way in before. CVE-2023-27350 entered the KEV catalog in April 2023 as an improper access control flaw in the SetupCompleted class that allowed authentication bypass and code execution as system, and CISA flags it as known ransomware campaign use. Huntress documented the result at the time: commands spawning from pc-app.exe, PowerShell pulling an Atera RMM installer, then a second-stage batch file that disabled Defender and dropped a Monero miner. Its detection advice was to watch for anomalous access to the SetupCompleted page and for child processes under pc-app.exe.
Three years later the 2026 bulletin lists the identical process signal: pc-app.exe or pc-app launching cmd.exe, including whoami & ver. A detection written for the 2023 bug fires on the 2026 one because the code path leads back to the same unguarded setup flow. If you still have that Sigma rule or that EDR exception from 2023, it is live inventory, not history.
Verify the build, then look for the class file
Start with the number, because the number is the only thing that settles the question. PaperCut's documented route is the admin interface at http://server:9191/admin, under About, then Version info, which shows both version and build. Windows Programs and Features reports the originally installed version and will tell you a comforting lie. On disk, the server WAR carries the version in its filename, which is the fastest read across several servers.
# Windows: read the version off the server WAR on every PaperCut host
$hosts = Get-Content .\papercut-servers.txt
Invoke-Command -ComputerName $hosts -ScriptBlock {
Get-ChildItem 'C:\Program Files\PaperCut *\server\lib\pc*-server-*.war' |
Select-Object @{n='Host';e={$env:COMPUTERNAME}}, Name, LastWriteTime
} | Format-Table -AutoSize
# Linux / macOS install
ls -l /opt/papercut/server/lib/pc*-server-*.war \
/Applications/PaperCut*/server/lib/pc*-server-*.war 2>/dev/null
Anything below 24.1.10, 25.0.13 or 26.0.5 is unfinished work, and so is any 26.0.4-PO build. Do the Site Servers and secondary print servers as well; the bulletin is explicit that the primary Application Server is not the whole job.
Grep the vendor's indicators, not a generic signature
PaperCut published real strings, which is more than most vendors manage mid-incident. The exploitation attempt leaves its own fingerprints in server.log, and the clearest of them is a Java class magic number arriving through a card-lookup SQL statement.
# PaperCut Application Server logs: vendor-published exploitation artefacts
LOGS='/opt/papercut/server/logs' # Windows: \server\logs
grep -aiE 'No suitable driver found for jdbc:no:x|jdbc:derby:memory:pwn|VALUES CAST\(X.cafebabe|Database error looking up cardID' \
"$LOGS"/*.log
# Dropped payload artefacts (5-character random names)
ls -l "/server/lib/"?????.class \
"/server/data/content/"?????.cmd \
"/server/data/content/"?????.out 2>/dev/null
# Post-compromise persistence the bulletin names
sc.exe query "Remote Access Service"
dir "C:\ProgramData\JWrapper-Remote Access" "C:\ProgramData\ace.exe"
A missing, truncated or deleted server.log counts as a finding, not a gap. The bulletin also warns that the absence of these indicators does not confirm the server is clean, so treat a quiet grep as one input rather than a verdict. For the authentication bypass specifically, watchTowr released a detection artefact generator that requests a form through /Home and reads the answer: a 200 naming the target page means the bypass works, a 302 back to a /Home endpoint means it does not. It stops short of code execution, which makes it safe to run against production.
If any of it hits, PaperCut's own guidance is the correct guidance and it is blunt: secure current backups, wipe and rebuild the Application Server, and restore from a backup taken before the suspicious activity. A server that loaded attacker bytecode as the service account is not repaired by an upgrade.
Get every PaperCut server to 26.0.5, 25.0.13 or 24.1.10
Print management sits in an awkward place for a small IT team. It runs on a server nobody logs into, under a service account with local privilege, and it is almost never in the patch cadence that covers the hypervisor and the domain controllers. That is exactly the profile of the host that still runs 26.0.4 with an August change ticket closed against it.
Work it in this order today. Build the list of PaperCut hosts, including Site Servers. Read the build number off each one rather than trusting the ticket. Upgrade anything short of the September 10 maintenance releases, and schedule the branch upgrade for anything on version 23 or earlier. Then run the log greps on every host you touched, because the patch tells you nothing about the two weeks before it.
We do this work with clients whose print server turned out to be the oldest unmanaged Windows box in the building. If you want a second set of eyes on whether yours was reached before it was patched, that is a conversation worth having this week rather than after the restore.
Not sure whether your print server was reached before it was patched?
We help organizations confirm whether an actively exploited server was compromised in the window before the fix landed, and rebuild it safely when it was. Book a session with our team to work through your internet-facing and service-account-heavy hosts.