Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-81578 8.8
PaperCut · NG/MF · Added 2026-08-31 · Published 2026-08-28
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityPaperCut NG/MF Missing Authentication for Critical Function Vulnerability
VendorPaperCut
ProductNG/MF
Date added2026-08-31
Due date2026-09-14
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-306
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Descriptions

KEV: PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

NVD: An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impactpartial
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-31 18:02 UTC
Searches8
Component defaultyes
Sources https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
https://www.huntress.com/blog/papercut-actively-exploited
https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
https://threatprotect.qualys.com/2026/08/31/papercut-ng-mf-zero-day-vulnerability-exploited-in-the-attacks-cve-2026-82078-cve-2026-81578/
https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog

Hunting hypothesis agent

Hunt PaperCut access logs for HTTP POST to /app with service=direct/ and Error or Home display paths paired with ConfigEditor components; monitor server.log for DB URL: jdbc:derby:memory: and base64 command output.

Research details

ComponentApache Tapestry complex-direct request handler (ConfigEditor and UserList admin components)
PreconditionsTarget must run an unpatched version of PaperCut NG or MF (all versions potentially affected prior to Emergency Patch Release 2). The web management interface must be network-reachable. No authentication is required; the attacker exploits an Apache Tapestry page/component confusion to bypass access checks on the ConfigEditor and UserList endpoints. agent
DeliveryHTTP POST to PaperCut web management interface (/app endpoint) using Tapestry complex-direct request format
Public PoCyes
PoC URLs https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
https://www.huntress.com/blog/papercut-actively-exploited Third-party repos; verify before use.
Advisoryhttps://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
Exploit notesThe exploit chain is fully public with working PoC tooling (yora1928 GitHub, Huntress reproduced it, Rapid7 Metasploit module available). Attacker sends HTTP POST to /app?service=direct/1/{Error|Exception|Home}/ConfigEditor/ to bypass auth and reconfigure external DB lookup settings. CVE-2026-82078 then allows class loading for RCE. First emergency patch was bypassed via Home page display path; Release 2 fixes this. Huntress observed exploitation lasting under two minutes.
SummaryPaperCut NG/MF contains an authentication bypass in its Apache Tapestry-based web management interface (CVE-2026-81578) that, when chained with CVE-2026-82078 (unsafe dynamic class loading), enables pre-authentication remote code execution. The vulnerability is actively exploited in the wild, confirmed by Huntress, Rapid7, and CISA KEV listing. Emergency Patch Release 2 is available for versions 24, 25, and 26; organizations must restrict public access and patch immediately.

Tia coverage

First reported2026-08-27
First exploit report2026-08-28
Exploit report → KEV3 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-pagreynoise-agents-gone-wild-an-ai-orchestrated-global-campaign-ag

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub