Vulnerability
A high-severity PaperCut NG/MF vulnerability allowing unauthenticated requests to load attacker Java code into the server process.
PaperCut flaws tracked under three CVEs chain into code execution before login, according to an analysis published on dev.to. No credentials are needed, so any host that can send the server a print job is within reach of the chain until fixed builds are confirmed.
Reality
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality
Arctic Wolf reports the two newly disclosed PaperCut bugs being used together against K-12 and university print servers in the US and Europe, with collection aimed at the directory credentials the server stores to do its job.
Perspective Coverage
3 publishersReality
Huntress has seen exploitation in two customer environments. One flaw hands over PaperCut's configuration without a login, the second turns that configuration into a class loader, so patching and config review are one job.
Perspective Coverage
10 publishersReality
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.
Reality
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
Reality
PaperCut says the advisory covers all releases of NG and MF, that exploitation is already happening in customer environments, and that its fix is an emergency patch built outside the normal release process.
Reality
PaperCut shipped emergency fixes for CVE-2026-81578 and CVE-2026-82078 on Thursday and Friday, and by the weekend Defused was watching honeypot intruders bypass authentication and read database tables instead of running code.
Reality
PaperCut has shipped a second emergency patch after bypass vectors survived the first one, and the chain being exploited runs from an unauthenticated HTTP request to code execution on the print server.
Reality