6 mincritical
PaperCut Actively Exploited: A Pre-Auth RCE Chain
Pre-auth RCE chain in PaperCut NG and MF (CVE-2026-81578, CVE-2026-82078) is actively exploited in the wild, dropping Java payloads that execute discovery commands and delete logs. Two CVEs chain improper access control and unsafe class-loading to enable unauthenticated remote code execution in PaperCut Application Server. Huntress confirmed exploitation in two customer environments where attackers dropped Java .class files executing whoami, ver, and tasklist as SYSTEM. Payloads delete server.log and themselves. Patches exist for v25 and v26; v24 fixes in progress; v23 and older have no patch.
Sens:■ ImmediateConf:
IOCs8
4filename2cve2file path
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Apply PaperCut emergency patch Release 3 for supported versions immediately.
- Remove PaperCut web management interface from public internet exposure.
- Isolate PaperCut servers running v23 or older where no patch exists.
- Audit PaperCut servers for .class files in server/lib before patching.
Key Takeaways
- 47% of ~2,500 tracked PaperCut installations run v23 or older with no patch available.
- Release 3 supersedes prior emergency patches; no need to install Releases 1 or 2 first.
- Payload drops .class files to server/lib and writes command/output to data/content/.
- Derby database named 'pwn' in logs is a high-confidence IOC.
- Exploitation lasted under two minutes in one observed incident.
Attack Chain
- Initial Access: Unauthenticated attacker sends crafted request to PaperCut web interface exploiting CVE-2026-81578 access control bypass
- Execution: Modified configuration triggers unsafe class-loading via CVE-2026-82078, dropping Java .class file to server/lib/
- Discovery: .class file decodes base64 commands and executes whoami, ver, tasklist via ProcessBuilder as SYSTEM
- Defense Evasion: Payload deletes server.log, Udydn.out, Udydn.cmd, and itself to remove forensic evidence
- Impact: Attacker has SYSTEM-level code execution on PaperCut Application Server for further post-exploitation
Affected Systems
- PaperCut NG (all versions)
- PaperCut MF (all versions)
- PaperCut v23 or older (no patch)
- Windows servers running PaperCut Application Server
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-81578 | PaperCut NG/MF web management interface | Critical | Improper access control allows unauthenticated attacker to modify system configurations. |
| CVE-2026-82078 | PaperCut NG/MF database connection utilities | Critical | Unsafe dynamic class-loading allows execution of arbitrary Java bytecode. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process spawning, file creation, and file deletion by pc-app.exe are visible to EDR. |
| Network Visibility | Medium | HTTP requests to PaperCut interface visible but payloads are hex or base64 encoded. |
| Detection Difficulty | Moderate | Specific log strings and file artifacts are identifiable but anti-forensics delete key logs quickly. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| pc-app.exe or Java process spawning command shells or discovery utilities like whoami.exe, tasklist.exe (T1059, T1087, T1057) | EDR process telemetry | Execution | Low — pc-app.exe spawning shells is abnormal |
| Unexpected .class files created under PaperCut server/lib directory by the application process (T1105) | File integrity monitoring or EDR file events | Execution | Low — .class files in lib dir are not normally created at runtime |
| Derby database with irregular name 'pwn' appearing in PaperCut logs or process arguments (T1210) | PaperCut server.log and derby.log | Execution | Low — 'pwn' as database name is attacker-specific |
| Deletion of server.log files from PaperCut logs directory by the application process (T1070.002) | EDR file deletion events or FIM | Defense Evasion | Medium — log rotation may trigger similar events |
Required Log Sources
- PaperCut server.log
- EDR process telemetry
- File integrity monitoring
- Windows Security Event Logs
- Web server access logs
Key Behavioral Indicators
- pc-app.exe spawning cmd.exe, charmap.exe, or discovery tools
- Unexpected .class files in PaperCut server/lib directory
- DB URL: jdbc:derby:memory:pwn in server.log
- ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
- ERROR No suitable driver found for jdbc:no:x in server.log
- Deleted or truncated server.log files in PaperCut installation
Control Gaps
- WAF may not detect encoded payloads in SQL CAST statements
- AV signatures unlikely to flag Java .class files as malicious
- Log deletion by payload removes primary forensic evidence
- Network-only monitoring misses process-level execution artifacts
False Positive Assessment
Low — Specific log strings, .class filenames, and Derby database name 'pwn' are highly indicative of exploitation. Log rotation may mimic server.log deletion.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict PaperCut Application Server access to trusted IPs or VPN only.
- Deploy WAF rules blocking crafted requests targeting PaperCut auth bypass.
- Enable file integrity monitoring on PaperCut server/lib and data/content directories.
- Monitor PaperCut server.log for jdbc:derby:memory:pwn and CAST error strings.
User Protection
- Preserve server/logs directory and endpoint process trees before remediation.
- Review scheduled tasks, services, and autoruns on PaperCut Application Servers.
- Verify PaperCut external user-lookup configuration for unauthorized changes.
- Block outbound traffic from PaperCut servers to unknown destinations.
Security Awareness
- Notify IT teams that PaperCut management interfaces must not be internet-exposed.
- Document PaperCut server hardening requirements in deployment standards.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Lateral Movement
Tactic
Command and Control
Additional IOCs
- File Paths:
C:\Program Files\PaperCut MF\server\lib\Udydn.class- Recovered malicious Java class on Windows serverC:\Program Files\PaperCut MF\server\lib\Moo97.class- Second copy of malicious Java class on Windows server
- Command Lines:
- Purpose: System discovery: identify user account and OS version | Tools:
whoami,ver| Stage: Discovery |whoami & ver - Purpose: System and process discovery: identify user, OS, running processes | Tools:
whoami,ver,tasklist| Stage: Discovery |whoami & ver & tasklist - Purpose: Execute commands from .class payload via ProcessBuilder on Windows | Tools:
cmd.exe| Stage: Execution |cmd /c
- Purpose: System discovery: identify user account and OS version | Tools:
- Other:
jdbc:derby:memory:pwn- Database URL in logs indicating exploitation activityd2hvYW1pICYgdmVy- Base64-encoded discovery command (whoami & ver)d2hvYW1pICYgdmVyICYgdGFza2xpc3Q=- Base64-encoded discovery command (whoami & ver & tasklist)
Showing defanged values
- cveCVE-2026-81578Improper access control allows unauthenticated attacker to modify system configurations.
- cveCVE-2026-82078Unsafe dynamic class-loading allows execution of arbitrary Java bytecode.
- filenameMoo97.classSecond malicious Java class file dropped by exploit
- filenameUdydn.classMalicious Java class dropped by exploit for RCE
- filenameUdydn.cmdCommand file written by payload to data/content/
- filenameUdydn.outOutput file from command execution, deleted after
- file_pathC:\ProgramFiles\PaperCutMF\server\lib\Moo97.classSecond copy of malicious Java class on Windows server
- file_pathC:\ProgramFiles\PaperCutMF\server\lib\Udydn.classRecovered malicious Java class on Windows server