On August 26, security researchers at Huntress identified anomalous activity in customer logs involving base64-encoded commands like whoami and tasklist. This activity signaled the exploitation of PaperCut NG and MF, specifically targeting a chain of vulnerabilities that would soon be formally assigned as CVE-2026-81578 and CVE-2026-82078.
The Mechanics of the Chain
The attack relies on a two-stage exploit chain that achieves pre-authentication remote code execution (RCE). First, CVE-2026-81578, an authentication bypass vulnerability with a CVSS score of 8.8, allows an attacker to circumvent login requirements. Once inside, the attacker modifies the system configuration, specifically targeting the database connector. This sets the stage for the second vulnerability, CVE-2026-82078, an unsafe dynamic class loading flaw with a CVSS score of 9.4. By injecting a crafted JDBC URL, the attacker forces the PaperCut Application Server to load an attacker-controlled Java class. This sequence effectively grants the attacker full control over the server without requiring valid credentials.
Automated Pipeline and Iterative Development
Observations from watchTowr honeypots confirm that this is not a manual process. The observed pipeline is fully automated, beginning with mass scanning and fingerprinting, followed by the auth bypass, configuration modification, and the injection of the malicious JDBC URL. The pipeline even includes the delivery of a hex-encoded .class payload. Perhaps most notable is the evidence of iterative development. In one instance, a single actor attempted the exploit, failed to deploy the implant, debugged the payload, and returned approximately one hour later to successfully execute the attack. This level of automation and self-correction indicates the use of automated pipelines to weaponize vulnerabilities at scale.
In-Memory Persistence and Evasion
Post-exploitation activity focuses on maintaining access while evading traditional file-based detection. Attackers have been observed deploying the Godzilla C2 webshell and the suo5 proxy tunnel as Jetty servlet filters. Because these components reside entirely in-memory, they are difficult to detect using standard disk-scanning tools. For more permanent access, the attackers deploy legitimate remote management tools, specifically SimpleHelp and AnyDesk, configured to run as LocalSystem with auto-start capabilities. Further post-compromise actions include dumping Windows registry hives to extract the SAM database BootKey and harvesting credentials to facilitate lateral movement.
Remediation Constraints
The impact of these vulnerabilities is compounded by the inability of many organizations to patch. While PaperCut has released fixes in versions 26.0.5, 25.0.13, and 24.1.10, there are no patches available for version 23 or earlier. Data from Huntress indicates that 47% of the approximately 2,500 PaperCut installations they track are running these unpatchable, legacy versions. Furthermore, the initial emergency patches were found to be bypassable via the Home page display, necessitating subsequent hardening in later releases. The education sector, including K-12 schools and universities, along with government and healthcare entities, remain the primary targets for these campaigns.
Contextualizing the Incident
This incident serves as a follow-up to previous reporting on PaperCut authentication gap. Attackers are treating software vulnerabilities as modular components in a larger, highly efficient machine. Relying on file-based detection is increasingly insufficient when persistence mechanisms are designed to live exclusively in memory.