Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs

watchTowr Labs published a pre-auth remote code execution chain against PaperCut NG and MF on 2026-10-09, built on an authentication bypass and tracked as CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578. The post carries four watchTowr tracking ids, WT-2026-0141 through WT-2026-0144, against those three CVE numbers, and its title states plainly that the chain defeats existing patches. The watchTowr summary describes authentication bypass and RCE chains in the wild, and the story record carries a KEV flag with critical-severity weighting.

The id mismatch is the story. Four tracker ids against three CVEs means at least one finding in the chain was published without a CVE assignment, and scanner and patch-verification tooling keys on CVE ids. A shop that validates remediation by scanning for the three published CVEs can come back clean while remaining exploitable through the unnumbered flaw. Layer on the patch-bypass claim and the exposed population is larger than it looks: any site that applied the earlier PaperCut fix and stopped verifying is still in scope, because patch state is not a binary when the researcher says the fixes miss. PaperCut NG and MF are print management products that typically run on domain-joined servers holding service credentials, so pre-auth code execution there is a network foothold, not a single-host problem. Coverage is also still single-source, labs.watchtowr.com with no secondary pickup yet, and that quiet window between researcher disclosure and broad reporting is where opportunistic exploitation historically does its best work.

Actions are verifiable even with the vendor advisory still absent from coverage. Inventory PaperCut NG and MF deployments first and map which print servers expose the management or user web interfaces beyond management networks or VPN, because pre-auth means interface exposure equals bug exposure. Treat prior patching as unverified until the full chain is retested, and validate fixed versions against the detail in the watchTowr post rather than CVE-based scan output alone, since the post claims the earlier fixes are bypassed. For hunting, the watchTowr post is the grounding artifact: mine it for request signatures and any included payloads, review print server access logs against those patterns, and track KEV entries tied to the three CVEs. Chasing the vendor for a fixed-version table, including a CVE mapping for the WT-2026-014x items that lack one, belongs on the same task list.

Two developments would change the assessment. A vendor advisory with fixed versions and a CVE mapping for the unnumbered WT-2026-014x findings converts this into something scanners can see and lets defenders close the gap the CVE scan misses. Independent exploitation telemetry, GreyNoise or Shodan style, showing scanning at scale against PaperCut endpoints would move this from researcher disclosure to campaign and justify emergency patching of every exposed instance, KEV listing or not.