PaperCut Authentication Bypass and Dynamic Class Loading: Pre-authentication RCE Chain Actively Exploited

PaperCut has released an emergency patch to address two critical vulnerabilities that allow unauthenticated remote attackers to execute Java code with server process privileges. These vulnerabilities stem from an authentication bypass combined with insecure dynamic class loading.

CVE-2026-81578 enables attackers to reach backend management operations and modify settings before authentication checks are performed. Meanwhile, CVE-2026-82078 fails to restrict database driver class names via a whitelist, enabling the execution of Java bytecode specified by adversaries on the classpath.

Attackers connect to the management interface and exploit these flaws to load malicious Java classes, which are then executed by the `pc-app.exe` process with SYSTEM privileges. This allows them to delete output files, manipulate server logs, and potentially perform additional malicious actions.

To mitigate these threats, users are strongly advised to apply the second emergency patch (Release 2) and update any versions prior to v23 to the latest release line. Additionally, administrators should restrict access to the management interface to trusted IP addresses or VPNs, prevent the placement of unknown classes in the `server/lib` directory, and block shell execution by `pc-app.exe`.

Detection of exploitation or abnormal behavior in PaperCut MF/NG should be triggered by observing a process tree where `pc-app.exe` spawns utilities such as `whoami`, `ver`, `tasklist`, and `cmd.exe`, the presence of unexpected `.class`, `.cmd`, or `.out` files under `server/lib`, and the absence of `server.log`. Endpoint and Identity/IdP logs may also contain indicators of compromise, such as errors in `derby.log` or attempts to connect to unknown database resources.