Today’s Topics:

• PaperCut Zero-Days Turn Trusted Print Servers Into a Pre-Auth RCE Path
• The ATF Breach Shows Why an Isolated System Can Still Hold High-Consequence Risk
• How can Netizen help?

---

PaperCut Zero-Days Turn Trusted Print Servers Into a Pre-Auth RCE Path

PaperCut entered emergency-response mode in late August after confirming active exploitation against PaperCut NG and PaperCut MF servers. What first appeared as a single zero-day developed into a two-vulnerability attack chain capable of giving an unauthenticated remote attacker code execution inside the PaperCut Application Server. The vulnerabilities, CVE-2026-81578 and CVE-2026-82078, affect the management and database functionality of a platform commonly deployed across schools, universities, businesses, government organizations, healthcare environments, and other networks that centralize print management. PaperCut disclosed the activity on August 27 after confirmed customer incidents and issued emergency patches soon after. By August 31, the company was still investigating the attacks and working toward a normal product release.

The first vulnerability, CVE-2026-81578, carries a CVSS 4.0 score of 8.8. It is an improper access-control flaw in the PaperCut web management interface. Under certain conditions, a remote request can reach administrative backend functionality before the application completes the access-validation process. The result is more significant than simple unauthorized access to a page. An unauthenticated attacker can manipulate selected server configuration values that should require administrative authorization.

That configuration access provides the bridge to CVE-2026-82078. The second flaw carries a CVSS 4.0 score of 9.4 and exists in PaperCut’s database connection utilities. PaperCut permits configurable database-driver class names, yet affected releases do not restrict those class selections to a defined allowlist. If an attacker already has the ability to manipulate the relevant configuration, the server can be induced to instantiate attacker-selected Java classes from its application classpath. The result is arbitrary Java bytecode execution under the security context of the PaperCut server process.

The distinction between the individual CVSS scores and the combined attack path matters. CVE-2026-82078 formally requires high privileges when assessed independently, since manipulating the relevant configuration would ordinarily require administrative access. CVE-2026-81578 changes that condition. The access-control flaw supplies the configuration access needed to reach the unsafe class-loading behavior. Chained together, the vulnerabilities remove the authentication requirement and create a pre-authentication remote-code-execution path. Huntress reproduced the chain against a stock PaperCut installation and demonstrated code execution originating from the pc-app.exe Application Server process.

Evidence from real intrusions shows how attackers moved from PaperCut application behavior into operating-system execution. Huntress identified exploitation in two customer environments, including activity on August 26, before PaperCut publicly disclosed the issue. In one incident, PaperCut logs contained Base64-encoded commands that decoded to whoami & ver, allowing the attacker to identify the account context and Windows version. A second incident added tasklist, giving the attacker visibility into running processes.

Researchers also recovered malicious Java class files associated with the exploitation. One observed payload was written into PaperCut’s server\lib directory as Udydn.class. Huntress decompiled the class and found code capable of executing commands on Windows or Linux, collecting system information, writing output into PaperCut’s content directory, and deleting artifacts after execution. A second class named Moo97.class was recovered from the same compromised system. The use of Java makes the technique relevant across the operating systems supported by PaperCut rather than restricting the attack logic to a single Windows-only implementation.

The class-loading step is especially interesting from a defensive perspective. Attackers do not need to introduce a traditional executable and then convince the operating system to launch it through an unrelated vulnerability. They can use PaperCut’s own Java runtime and application classpath as the transition from application-level configuration manipulation to code execution. The vulnerable database functionality becomes an execution primitive. Once attacker-controlled Java runs inside the Application Server, it can interact with the host under the privileges assigned to that process.

Huntress found evidence that the malicious class attempted to remove traces of its own operation. Output files were deleted after use, and PaperCut’s server.log was deleted after execution in one observed incident. That behavior makes log disappearance itself useful evidence. PaperCut now lists missing, unexpectedly shortened, or deleted server.log files among its indicators of compromise. Researchers also found useful traces in Derby database logs that survived the cleanup attempt, showing the creation of an unusual in-memory database immediately before code execution.

Later investigation showed post-exploitation activity moving beyond simple reconnaissance. PaperCut documented one observed sequence beginning with whoami, operating-system version discovery, process enumeration, domain-controller discovery through nltest, logged-on-user enumeration, and inspection of local user directories. Roughly sixteen minutes after the first observed command, the attacker downloaded an executable into C:\ProgramData. Minutes later, the host received a SimpleHelp remote-access agent installed as a Windows service running under LocalSystem. The attacker then downloaded AnyDesk.

That sequence changes the incident from a theoretical application-server compromise into a conventional foothold for hands-on-keyboard access. nltest /dclist: can identify domain controllers, quser can expose interactive sessions, and user-directory inspection helps attackers establish who uses the server. Remote-management software can then provide persistent interactive access without requiring the attacker to continue exploiting PaperCut for every action. SimpleHelp and AnyDesk are legitimate administration products, which can make their use less conspicuous than custom malware in environments where remote-support tools are common.

The execution context also raises the stakes. PaperCut Application Servers have historically operated under highly privileged service contexts. During exploitation testing, Huntress demonstrated an attacker-triggered process launched as SYSTEM beneath pc-app.exe. Code executing at that level can interact with the host with broad local authority. A compromised print-management server may also occupy a useful network position, with access to directory services, users, printers, databases, and other internal resources that an attacker can use for discovery or later movement.

Internet exposure increases the operational risk. PaperCut’s immediate guidance is to restrict Application Server web access to trusted addresses through firewalls, network controls, or a controlled administrative path. SecurityWeek reported roughly 1,000 PaperCut instances exposed to the internet during the initial response period, based on Shadowserver data. An exposed management server paired with a pre-authentication execution chain presents a very different risk profile from a flaw that requires an existing account or local access.

The patching process has also been unusual. PaperCut first issued an emergency patch outside its normal release process. Researchers working with the company later identified ways around the initial remediation, leading PaperCut to publish Emergency Patch Release 2 on August 28 with further hardening. PaperCut has told customers to install Release 2 even if they already deployed the first emergency patch. Release 2 is available for supported branches 24, 25, and 26 across Windows, Linux, and macOS. Customers running release 23 or earlier are directed to upgrade to a current supported version.

Current CVE records identify releases before 24.1.10, 25.0.13, and 26.0.5 as affected. PaperCut’s live bulletin remains the better operational reference during the response period, since the company continues to update emergency-patch instructions and investigation findings. Site Servers and secondary or print servers need patched versions too. PaperCut says Print Deploy and Mobility Print are not affected by this vulnerability pair.

Detection cannot stop at checking whether a patch is installed. Systems that were internet-accessible before remediation need retrospective investigation. PaperCut has identified several server-log strings associated with exploitation, including references to jdbc:derby:memory:pwn, unusual database-driver values, and card-ID database errors containing Java-class data. Five-character .class files under server\lib, matching .cmd or .out artifacts under server\data\content, command-shell child processes launched from pc-app.exe, and unexplained SimpleHelp or AnyDesk deployments are also useful investigation leads.

Absence of those artifacts cannot establish that a host is clean. The malicious Java observed by Huntress deletes files and logs, and PaperCut explicitly warns that attackers may clean up the files listed in its advisory. Defenders should preserve PaperCut logs, file metadata, endpoint telemetry, DNS history, firewall records, reverse-proxy logs, service-creation records, scheduled tasks, and process trees before rebuilding or restarting systems where compromise is suspected. PaperCut recommends completely wiping and rebuilding a suspected Application Server and restoring a clean backup from before the suspicious activity.

The incident also carries historical context. PaperCut servers were heavily exploited in 2023 through CVE-2023-27350, another authentication-bypass and remote-code-execution issue. FBI and CISA later documented exploitation by multiple actors, including ransomware activity against education-sector organizations. The present flaws are technically different, yet the operational lesson is familiar: centralized infrastructure that appears mundane can become a high-value entry point once it offers remote execution and sits inside trusted enterprise networks.

Print servers rarely receive the same defensive attention as identity platforms, VPN concentrators, domain controllers, or public web applications. PaperCut’s 2026 incident shows why that assumption can fail. The exposed service is not merely handling print jobs. It is an enterprise application with administrative interfaces, server-side Java execution, directory integrations, databases, and a privileged operating-system process. Once authentication controls and dynamic class loading combine into an exploitable chain, that overlooked print server can become the attacker’s first trusted execution point inside the network.

---

The ATF Breach Shows Why an Isolated System Can Still Hold High-Consequence Risk

The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cybersecurity incident on August 26 involving a standalone computer system containing information about targets of ATF investigations. ATF disconnected the affected environment after discovering the compromise and began forensic and incident-response work with the Department of Justice. Senior Justice Department officials designated the event a federal “major incident,” placing the breach into a category reserved for incidents with potentially serious effects on government interests, civil liberties, public confidence, national security, or related areas.

The most significant confirmed detail is the system’s data. An ATF spokesperson told Recorded Future News and Reuters that the compromised environment contained information about targets of ATF investigations. That makes the event materially different from an intrusion into a generic administrative server. Investigative information can carry operational value independent of the technical importance of the system storing it. Even a well-segmented host can contain data whose unauthorized disclosure creates risks for active investigations, law-enforcement personnel, cooperating agencies, witnesses, investigative subjects, or future enforcement activity.

ATF says the affected system operated separately from its enterprise environment. The agency has reported no indication that the incident affected its enterprise network, eForms platform, case-management systems, laboratory systems, or other ATF systems. The standalone system was quickly shut down after discovery, and ATF says the incident has not impaired its ability to carry out its mission. Those facts point to a degree of successful containment: the compromise has not been publicly shown to have propagated across the agency’s broader infrastructure.

That containment should not be confused with low impact. Segmentation controls the pathways an attacker can use between systems. It does not reduce the sensitivity of information already stored inside a compromised segment. An isolated database containing valuable investigative information may present greater confidentiality risk than a broadly connected system holding routine operational data. The ATF incident is a useful example of the difference between limiting network blast radius and limiting data exposure.

The word “standalone” also needs careful interpretation. ATF has said the environment was separate from other agency systems and was not connected to its case-management, laboratory, or eForms platforms. Public disclosures have not described its hosting architecture, external connectivity, authentication model, administrative interfaces, remote-access methods, operating system, data stores, or the route used by the attacker. Calling the system standalone does not establish that it was physically air-gapped or inaccessible from outside networks. The available evidence supports separation from other ATF systems, not assumptions about every communication path into the compromised environment.

The initial access vector also remains unknown. ATF has not disclosed whether the intrusion involved stolen credentials, a vulnerable internet-facing service, remote-access infrastructure, social engineering, a third-party connection, malware delivery, or another technique. The agency has not publicly stated when attackers first entered the environment, how long access persisted, what accounts were compromised, or what security controls detected the activity. Those gaps limit any technical reconstruction of the intrusion.

The amount and type of data accessed are also unresolved. ATF has confirmed that the system contained information about investigation targets, yet the agency has not publicly identified the exact records involved or confirmed the volume of information viewed or removed. There has been no public disclosure of the number of affected investigations, the age of the records, whether the information included personally identifiable information, or whether active operational material was exposed. Any claim assigning a specific volume or category of stolen ATF data would exceed the confirmed public record as of August 31.

The ransomware operation Qilin claimed responsibility after listing ATF on its leak site. Reuters reports that the group offered no description of the allegedly stolen material, no quantity, and no samples supporting the claim at the time of publication. ATF and the Justice Department have not publicly attributed the incident to Qilin. The distinction matters. Ransomware leak sites routinely function as pressure mechanisms and criminal advertising channels, and a threat actor’s claim is evidence to investigate rather than official attribution.

Qilin is still relevant context. Reuters reports that the operation has listed nearly 2,400 claimed attacks across more than 100 countries since appearing in October 2022. That figure describes claims associated with the group rather than independently verified compromises in every case. Its decision to name a federal law-enforcement agency creates a high-profile extortion scenario, yet there is still no public confirmation that ransomware encryption occurred on the ATF system. The confirmed event is a cybersecurity breach of the standalone environment. Encryption, ransom negotiations, payment demands, and confirmed exfiltration details remain undisclosed.

The federal “major incident” designation provides another indicator of the seriousness assigned to the event. Under federal guidance, an incident can qualify as major when it is likely to produce demonstrable harm to national-security interests, foreign relations, the economy, public confidence, civil liberties, public health, or public safety. A breach involving personally identifiable information can also qualify when compromise of that information is likely to create comparable harm. Major-incident determinations trigger elevated federal reporting and coordination requirements, including congressional notification under FISMA.

The designation does not mean officials have confirmed the worst possible outcome. It indicates that the event met the federal threshold for elevated treatment based on its potential impact and available facts. In the ATF case, the nature of the affected data provides a clear reason for caution. Information about targets of federal investigations can create consequences that are difficult to measure through conventional breach metrics such as record count or downtime.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---