{
  "title": "PaperCut NG/MF Authentication Bypass and Code Execution",
  "id": "b7e2d9f3-8c4a-4b1e-a6d7-2f3e4c5b6a78",
  "status": "experimental",
  "description": "Detects exploitation attempts against PaperCut NG/MF authentication bypass (CVE-2026-81578) and unsafe dynamic class loading (CVE-2026-82078) that allow unauthenticated remote code execution.",
  "author": "Tia N. List",
  "date": "2026-08-29",
  "references": [
    "https://www.rapid7.com/",
    "https://www.bleepingcomputer.com/"
  ],
  "tags": [
    "attack.t1190",
    "attack.t1505"
  ],
  "logsource": {
    "product": "windows",
    "category": "process_creation"
  },
  "detection": {
    "selection": {
      "Image|endswith": "\\pc-app-server.exe",
      "CommandLine|contains": "loadDatabaseDriver"
    },
    "condition": "selection"
  },
  "falsepositives": [
    "Legitimate PaperCut administrative operations"
  ],
  "level": "high"
}