PaperCut NG/MF flaw chain: CISA deadline passed, patch to the new builds

PaperCut has replaced its emergency patches with formal maintenance releases -- 26.0.5, 25.0.13 and 24.1.10 -- for PaperCut NG and PaperCut MF, closing two chained vulnerabilities that CISA added to its Known Exploited Vulnerabilities catalog on 31 August. The federal remediation deadline, 14 September, has already passed.

Two flaws, one exploit chain

CVE-2026-81578 (CVSS 8.8) is a missing-authentication flaw in the web management interface: requests aimed at administrative functions can trigger backend actions before access checks complete, letting an unauthenticated attacker alter system configuration. CVE-2026-82078 (CVSS 9.4) is a separate, more serious issue in the database connection utilities, which instantiate driver classes from a configurable name without validating it against an allowlist -- an attacker who can reach that setting can get arbitrary Java bytecode executed under the PaperCut server process.

Chained together, the two flaws give an unauthenticated attacker a path to remote code execution on the Application Server. PaperCut has confirmed active exploitation and multiple customer incidents, and according to Rapid7's analysis a Metasploit module that validates exposure to the chain is already circulating.

Who is exposed

PaperCut NG and MF are print-management platforms used by more than 70,000 organizations worldwide, including schools, government agencies, enterprises and the MSPs that manage them. All versions of NG and MF were flagged as potentially affected before the current fix, and a PaperCut server sits close to authentication, quotas and document workflows -- a useful foothold if compromised.

What to do this week

• Inventory every Application Server in your estate, including site and secondary servers, not just the primary instance.
• Upgrade to 26.0.5, 25.0.13 or 24.1.10 depending on your branch -- these supersede the earlier emergency Release 1-3 patches and include additional hardening.
• Until upgraded, restrict the Application Server's web management interface to trusted administrative networks only.
• If compromise is suspected, PaperCut's guidance is to rebuild from a known-clean backup rather than trust an in-place fix.

CISA's 14 September deadline is a binding requirement for US federal civilian agencies, not a universal one -- but with confirmed exploitation and a public exploit chain, every other PaperCut operator should treat it as the same operational target.

Sources: PaperCut security bulletin, CISA KEV alert, Rapid7 analysis.