CTI · reported · 2026-08-29
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Actors
Unknown
Malware / tools
—
Campaigns
—
CVEs
CVE-2026-81578CVE-2026-82078
Victim sectors
enterpriseeducationgovernment
Geography
—
MITRE ATT&CK
Indicators
No curated indicators tied to this case.
Detections
Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.
Sigma raw
{
"title": "PaperCut NG/MF Authentication Bypass and Code Execution",
"id": "b7e2d9f3-8c4a-4b1e-a6d7-2f3e4c5b6a78",
"status": "experimental",
"description": "Detects exploitation attempts against PaperCut NG/MF authentication bypass (CVE-2026-81578) and unsafe dynamic class loading (CVE-2026-82078) that allow unauthenticated remote code execution.",
"author": "Tia N. List",
"date": "2026-08-29",
"references": [
"https://www.rapid7.com/",
"https://www.bleepingcomputer.com/"
],
"tags": [
"attack.t1190",
"attack.t1505"
],
"logsource": {
"product": "windows",
"category": "process_creation"
},
"detection": {
"selection": {
"Image|endswith": "\\pc-app-server.exe",
"CommandLine|contains": "loadDatabaseDriver"
},
"condition": "selection"
},
"falsepositives": [
"Legitimate PaperCut administrative operations"
],
"level": "high"
}