[HIGH PRIORITY] PaperCut NG/MF Authentication Bypass (CVE-2026-81578)

⚠ HIGH PRIORITY — CISA KEV (Aug 31, 2026). CVE-2026-81578 is a missing authentication flaw (CWE-306) in the PaperCut NG/MF web management interface. Unauthenticated remote attackers modify critical system configurations — the entry point chained with CVE-2026-82078 for full pre-auth RCE on the Application Server.

Attack chain

1. CVE-2026-81578: unauthenticated config modification (auth bypass)
2. CVE-2026-82078: unsafe class loading executes attacker Java bytecode
3. Result: remote code execution without valid credentials

Affected systems

• PaperCut NG and MF Application Server — all versions potentially affected
• Self-hosted and cloud-managed print infrastructure
• Organizations with PaperCut exposed to WAN or guest networks

Verify exposure

curl -sk https://PRINT_SERVER:9191/app
nmap -p 9191,9192 PRINT_SERVER
# Check PaperCut admin → About for build number

Patching Method

1. Apply PaperCut Emergency Patch Release 2 (not Release 1 alone).
2. Target builds: 24.1.10, 25.0.13, 26.0.5 on Windows, Linux, or macOS.
3. Follow vendor upgrade process in security bulletin KB article.
4. After patch: confirm admin functions require authentication in browser session.
5. Review audit logs for unauthorized configuration changes since Aug 27, 2026.
6. Apply network ACL: restrict PaperCut ports to internal print VLAN only.
7. Enable MFA for PaperCut admin accounts where supported.

# PaperCut confirmed customer incidents — treat as breach if unpatched
grep -i 'config\|admin\|database' /opt/papercut/server/logs/*.log | tail -50

Until patched

• Isolate PaperCut Application Server from internet at firewall
• Disable remote admin access; use local console via VPN only
• Monitor Huntress/watchTowr IoCs published in vendor bulletin

CVSS 4.0: 8.8 High. Chained with CVE-2026-82078 for critical impact.