News Date: 2026-08-31
The active exploitation of PaperCut print-management servers has progressed beyond initial access. New findings show attackers installing legitimate remote-control software after exploiting a pair of vulnerabilities in PaperCut NG and PaperCut MF, giving them persistent and redundant access to affected environments.
Two Flaws Form a Dangerous Chain
The campaign combines CVE-2026-81578, an access-control weakness in the web management interface, with CVE-2026-82078, an unsafe dynamic class-loading issue in database connection utilities. Together, the vulnerabilities can allow an unauthenticated attacker to modify sensitive configuration settings and execute arbitrary Java bytecode under the PaperCut server process.
PaperCut reproduced the attack with assistance from external researchers and an affected university. The company released emergency fixes on August 28, followed later that day by a second hardened patch after researchers identified weaknesses in the initial remediation. Customers are advised to install the second release even if they already applied the first emergency update.
Attackers Build Redundant Access
Post-compromise activity has included user and privilege enumeration, process discovery, domain-controller identification and searches for active sessions. Attackers then downloaded a payload that installed SimpleHelp remote-access software and configured it to start automatically. AnyDesk was also deployed as a second access channel.
In my view, the use of legitimate remote-support products is a deliberate resilience strategy. Security software may not immediately block these applications because they are widely used for lawful administration. Two separate tools also allow the intruder to retain access if defenders discover and remove only one.
Required Response
- Apply the latest emergency patch to primary, secondary, site and print servers.
- Restrict the PaperCut management interface to trusted IP addresses.
- Preserve logs and forensic evidence before performing remediation.
- Search for unexpected SimpleHelp services, AnyDesk installations and child command shells launched by PaperCut processes.
- Upgrade installations older than version 24 to a supported release.
The absence of published indicators does not prove that a server is clean. Organizations finding evidence of compromise should consider rebuilding the application server and restoring a verified backup created before the suspicious activity.
I believe this incident is another warning that operational platforms can become privileged entry points. Print management may appear routine, but its servers often have extensive network visibility and domain connectivity. They should receive the same exposure management, monitoring and incident-response attention as other business-critical infrastructure.