CVE-2026-81578Active Exploitation(papercut / papercut_mf)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 30 mentions and remains active

Immediate actions

Patch papercut papercut_mf systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

papercut CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-14. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

Weakness type (CWE)

CWE-305

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

papercut_mf
papercut_ng

Threat summary

Active exploitation appears in 157 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
208 mentions across 32 observed days

What's happening

Active exploitation reported across 157 signals
Exploit tool or code specified in 23 signals
PoC mentioned or linked in 30 signals
Patch or workaround mentioned in 102 signals
Technical details provided in 137 signals
Disclosure: 11 classified signals
Peaked 28d ago at 30 mentions (2026-08-31); latest day: 1
208 total mentions across 32 days

Affected systems

Vendors

papercut

Products

papercut_mfpapercut_ng

Deep dive

Activity timeline208 mentions / 32d

Signal classification6 categories

Active Exploitation

14373.3%

Patch

2110.8%

Disclosure

115.6%

General

84.1%

PoC

84.1%

Exploit

42.1%

Referenced assets285 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-28	12	Active Exploitation6Disclosure1General2Patch3
2026-08-29	22	Active Exploitation12Disclosure1General1Patch5PoC3
2026-08-30	7	Active Exploitation6Patch1
2026-08-31	30	Active Exploitation22Disclosure2Exploit1General1Patch3PoC1
2026-09-01	26	Active Exploitation18Disclosure2Exploit1General1Patch2PoC2
2026-09-02	14	Active Exploitation8General1Patch3PoC2
2026-09-03	7	Active Exploitation6General1
2026-09-04	3	Active Exploitation3
2026-09-05	9	Active Exploitation9
2026-09-06	3	Active Exploitation3
2026-09-07	8	Active Exploitation5Disclosure2General1
2026-09-08	2	Active Exploitation1Exploit1
2026-09-09	8	Active Exploitation8
2026-09-10	6	Active Exploitation5Patch1
2026-09-11	7	Active Exploitation5Patch2
2026-09-12	4	Active Exploitation4
2026-09-13	1	Patch1
2026-09-14	8	Active Exploitation7Disclosure1
2026-09-15	2	Active Exploitation1Disclosure1
2026-09-16	3	Active Exploitation2Disclosure1
2026-09-18	1	Active Exploitation1
2026-09-19	2	Active Exploitation2
2026-09-20	1	Active Exploitation1
2026-09-22	1	Active Exploitation1
2026-09-30	9	Active Exploitation7Exploit1

Full discourse20 posts

Stephen Fewer@stephenfewer43d
Exploit
We have published our @metasploit exploit for the recent PaperCut MF and NG zero-day (CVE-2026-81578 + CVE-2026-82078) that is being actively exploited in-the-wild. Module supports both MF and NG editions, and all supported product versions 26.x, 25.x, 24.x. Bypasses vendor emergency patch v1. Emergency patch v2 successfully remediates the chain. Module also has platform agnostic Java payload support (and that will be in-memory on 26.x targets), along with OS command based payloads. https://github.com/rapid7/metasploit-framework/pull/21842
Post summary
Rapid7 released a Metasploit module exploiting CVE‑2026‑81578 and CVE‑2026‑82078, actively used in the wild, that bypasses vendor patch v1 but is mitigated by patch v2.
34601796011.8K
10.0K followersView on X
John Hammond@_JohnHammond46d
Active Exploitation
Been burning the midnight oil a lot this week to chase things -- latest escapade has been digging into PaperCut CVE-2026-81578 and CVE-2026-82078, pre-auth RCE. I recreated a PoC, coordinated with PaperCut, and we saw in-the-wild exploitation. More soon. https://www.huntress.com/blog/papercut-actively-exploited
Post summary
The post confirms that CVE-2026-81578 and CVE-2026-82078 (pre‑authentication RCEs) are being actively exploited in the wild, with a PoC already created and more details forthcoming.
82121303717.7K
327.3K followersView on X
watchTowr@watchtowrcyber4d
We're back - doing our best to explain the PaperCut saga, the litany of patch bypasses, and more. Enjoy, and happy Friday! https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
227094306.7K
14.2K followersView on X
Andrew Thompson@ImposeCost34d
Active Exploitation
AGENTS GONE WILD! This adversary used AI to download the advisory, download the pre and post patch versions of the software, built a lab to test the attack, and then went live against hundreds of identified victims vulnerable to CVE-2026-81578 and CVE-2026-82078.
Post summary
Adversaries used AI to acquire advisories, set up a lab, and actively exploited CVE-2026-81578 and CVE-2026-82078 against hundreds of vulnerable targets.
610074317.1K
41.9K followersView on X
blackorbird@blackorbird13d
Active Exploitation
Attackers exploited zero-day PaperCut MF flaws (CVE-2026-82078 / CVE-2026-81578) on an internet-facing print server to inject Java bytecode via SQL injection, load an in-memory Java servlet-filter loader, and deploy a Jetty web shell commanded through the X-Quad header. The webshell then fetched and ran a trojanized Microsoft Copilot PE (mscopilot.exe) that embeds an obfuscated AdaptixC2 implant
Post summary
The text describes active exploitation of PaperCut MF zero-day vulnerabilities (CVE-2026-82078 and CVE-2026-81578) involving SQL injection, Java bytecode manipulation, web shell deployment, and AdaptixC2 command-and-control infrastructure in real-world attacks targeting internet-facing print servers.
210158345.1K
44.1K followersView on X
Defused@DefusedCyber44d
Active Exploitation
🚨 We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th) An actor is abusing the auth bypass to hijack PaperCut's external user-lookup. Unlike the RCE path in public writeups, the actor goes for data theft - dumping DB tables via Derby ⚠️We haven't yet verified whether the exfil route is a working one Track emerging Papercut MF exploit activity 👉 http://console.defusedcyber.com/signup
Post summary
The report confirms that CVE-2026-81578 / CVE-2026-82078 are being actively exploited, with attackers using an auth bypass to steal database information from PaperCut. Monitoring continues while the exfiltration feasibility remains unverified.
212165197.9K
7.9K followersView on X
Jake@inkmoro33d
Active Exploitation
👀 @watchtowrcyber Intel captured real, hands-on-keyboard exploitation of the recent PaperCut NG/MF vulnerabilities, including fully decrypting webshell and C2 comms. Check it out: https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway
Post summary
Intel reports real hands‑on exploitation of PaperCut NG/MF vulnerabilities, decrypting webshell and C2 comms, signaling active attacks in the wild.
019043165.0K
278 followersView on X
Giuseppe `N3mes1s`@N3mes1s43d
PoC
As promised the repro of the PaperCut CVE-2026-81578 + CVE-2026-82078: From False Marker to Verified RCE plus update with the variant discovered! https://www.pruva.dev/reproductions/REPRO-2026-00340
Post summary
The tweet announces a proof‑of‑concept confirming Remote Code Execution for PaperCut CVE‑2026‑81578 and CVE‑2026‑82078, providing a link to the reproduction details and noting a newly discovered variant.
118043164.5K
13.5K followersView on X
CISA Cyber@CISACyber43d
Active Exploitation
🛡️ We added 2 PaperCut NG/MF vulnerabilities to our KEV Catalog: CVE-2026-81578, a missing authentication for critical function vulnerability, and CVE-2026-82078, an unsafe reflection vulnerability. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org. https://t.co/w5JDfzw9SJ
Post summary
DHS added two PaperCut NG/MF vulnerabilities (CVE‑2026‑81578 and CVE‑2026‑82078) to its KEV catalog, indicating active exploitation; it recommends applying mitigations to protect organizations.
21815139.7K
302.4K followersView on X
watchTowr@watchtowrcyber46d
Active Exploitation
🚨The watchTowr team is currently working with PaperCut directly to resolve bypasses in patches released for the actively exploited zero-day vulnerabilities (now CVE-2026-81578, CVE-2026-82078) in PaperCut NG/MF. This situation is evolving, and patches are being released iteratively. If you use PaperCut NG/MF, treat this as a trigger for incident response, and continue to monitor for updates.
Post summary
WatchTowr and PaperCut are addressing actively exploited zero‑day CVEs 2026‑81578 and 2026‑82078; patches are being iteratively released and users should treat the situation as an incident response trigger.
21013995.2K
14.1K followersView on X
YungBinary@YungBinary8d
We’ve published a new blog on an intrusion from last month involving #PaperCut vulnerabilities CVE-2026-82078 and CVE-2026-81578. https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578 Threat actors dropped a Java-based web shell and used it to download/execute an #AdaptixC2 implant which they then used to move laterally to a domain controller. Analyzing the PE files in this intrusion revealed threat actors patched a legitimate Microsoft Copilot binary to call a flattened AdaptixC2 main routine.
111132101.9K
2.1K followersView on X
YBE@Lumideezy38d
Active Exploitation
Attackers are actively exploiting PaperCut flaws (CVE-2026-81578 & CVE-2026-82078) for credential theft targeting schools and universities. Prioritize immediate patching and monitor for unauthorized accounts. #CyberSecurity #CyberAwareness
Post summary
Two PaperCut CVEs are being actively exploited for credential theft in schools and universities, so urgent patching is recommended.
8170263268
4.8K followersView on X
Virus Bulletin@virusbtn13d
eSentire's TRU team shows how a threat actor exploited an internet-facing PaperCut MF server to deploy a Java loader & a web shell. Threat actors subsequently used the web shell to deploy a trojanized Microsoft Copilot binary carrying an AdaptixC2 implant. https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578?utm_content=buffer77fc6&utm_medium=social&utm_source=twitter&utm_campaign=Buffer https://t.co/0jCIzgUuoy
08030102.4K
61.6K followersView on X
Aliz (they/them pls)@AlizTheHax0r33d
Active Exploitation
We threat intel now! https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/
Post summary
Threat intel signals that CVE‑2026‑81578 and CVE‑2026‑82078 are being actively exploited, yet no proof of concept, exploit code, patch, or detailed vulnerability description is included.
110276994
1.5K followersView on X
Nicolas Krassas@Dinosn4d
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
00115165.2K
162.5K followersView on X
The Shadowserver Foundation@Shadowserver31d
Active Exploitation
We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @GreyNoiseIO. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'. Dashboard Tree Map stats: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=other_value&day=2026-09-11&source=compromised_iot&source=compromised_website&source=compromised_website6&tag=papercut-compromise&data_set=count&scale=log&auto_update=on https://t.co/ANxXPBB11P
Post summary
The post reports that more than 400 PaperCut instances were compromised via CVE-2026‑81578 and CVE-2026‑82078, indicating active exploitation in the wild, but provides no PoC, exploit code, patch, or technical details.
11001342.5K
22.0K followersView on X
Rapid7@rapid746d
Active Exploitation
🚨 On 8/27/26, #PaperCut Software published an urgent security advisory, detailing active exploitation of a vuln affecting PaperCut NG & MF. PaperCut has confirmed customer incidents. More on CVE-2026-81578 and CVE-2026-82078 in our blog: https://r-7.co/46ysbxz https://t.co/M4TDzLgILO
Post summary
PaperCut announced that CVE‑2026‑81578 and CVE‑2026‑82078 are being actively exploited in the wild, with confirmed customer incidents.
1411666.3K
126.0K followersView on X
Florian Hansemann@CyberWarship5d
''CVE-2026-81578: PaperCut NG/MF CVE-2026-81578 + CVE-2026-82078 unauthenticated RCE chain'' #infosec #pentest #redteam #blueteam https://www.pruva.dev/reproductions/REPRO-2026-00340
11013123.1K
89.6K followersView on X
Dark Web Intelligence@DailyDarkWeb34d
Active Exploitation
🚨 AI-ORCHESTRATED PAPERCUT CAMPAIGN — 440 INSTANCES COMPROMISED GreyNoise says a likely Russian-speaking actor used AI-assisted workflows to develop, test, and operationalize exploits against PaperCut NG/MF on August 31, 2026. The campaign targeted CVE-2026-81578 and CVE-2026-82078 and moved from exploit development to global compromise at remarkable speed. Key numbers: * 440 PaperCut NG/MF instances compromised * 395 identified victim organizations * 48 countries impacted * 280 victims had credential harvesting activity * 147 had OS or domain secrets accessed * 12 organizations reached Domain Admin compromise * 204 victims were in the education sector Speed was one of the most notable elements: * Empty workspace → first real-world RCE in under 4 hours * First Domain Admin compromise roughly 2 hours later * At least 11 organizations compromised in 26 seconds once the campaign launched * Fastest observed path to Domain Admin: 5 minutes * One U.S. high school went from initial access to Domain Admin in 7 minutes The actor reportedly used hundreds of AI agents, OpenAI Codex as a harness, a DeepSeek model, and publicly available offensive security tooling to orchestrate reconnaissance, exploitation, credential theft, and lateral movement in parallel. Where Domain Admin was achieved, GreyNoise observed three main paths: * Harvesting LSASS and registry secrets from domain-joined PaperCut hosts, followed by pass-the-hash * Exploiting unpatched CVE-2021-42278 / CVE-2021-42287 via noPac * Abusing PaperCut systems already running on domain controllers or under Domain Admin service accounts All successful Domain Admin paths ultimately led to DCSync activity and NTDS.DIT credential extraction. Analyst Note: The important development here is not a new exploitation primitive. It is orchestration. AI allowed the actor to compress reconnaissance, exploit development, credential harvesting, and post-exploitation activity into massively parallel workflows operating at machine speed. But the campaign also reinforces something equally important: traditional defensive controls still matter. GreyNoise observed at least one exploitation attempt blocked by Cloudflare WAF, and basic measures such as patching, segmentation, reduced internet exposure, and Active Directory hardening remain effective. Same vulnerabilities. Much faster adversary. #DDW #CyberSecurity #ThreatIntelligence #AI #PaperCut #AgenticAI #Vulnerability #ActiveDirectory #OSINT
Post summary
GrayNoise reports an AI‑driven campaign that used CVE-2026-81578 and CVE-2026-82078 to achieve rapid, real‑world RCE and Domain Admin compromise across 440 PaperCut instances worldwide, demonstrating the speed of modern exploitation while emphasizing that standard defenses like patching remain effective.
1101286.6K
208.5K followersView on X
mRr3b00t@UK_Daniel_Card34d
Active Exploitation
Great blog post by @GreyNoiseIO !! this shows a TA exploiting PaperCut: CVE-2026-81578 and CVE-2026-82078 and then pivot and exploit networks further! you can see here armed with an LLM they did not just magically hack all the things! https://t.co/cr3O0oiXMA
Post summary
The tweet reports that a threat actor has exploited PaperCut using CVE‑2026‑81578 and CVE‑2026‑82078 and pivoted into further networks, indicating active exploitation in the wild.
0111064.5K
126.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	papercut	papercut_mf	-	-	-
App	papercut	papercut_ng	-	-	-

Explore more

Back to dashboard papercut CVEs papercut_mf vulnerabilities

What researchers are saying

CVE-2026-81578

Stephen Fewer[verified]@stephenfewerExploit

Rapid7 released a Metasploit module exploiting CVE‑2026‑81578 and CVE‑2026‑82078, actively used in the wild, that bypasses vendor patch v1 but is mitigated by patch v2.

John Hammond[verified]@_JohnHammondActive Exploitation

The post confirms that CVE-2026-81578 and CVE-2026-82078 (pre‑authentication RCEs) are being actively exploited in the wild, with a PoC already created and more details forthcoming.

Andrew Thompson[verified]@ImposeCostActive Exploitation

Adversaries used AI to acquire advisories, set up a lab, and actively exploited CVE-2026-81578 and CVE-2026-82078 against hundreds of vulnerable targets.

blackorbird[verified]@blackorbirdActive Exploitation

The text describes active exploitation of PaperCut MF zero-day vulnerabilities (CVE-2026-82078 and CVE-2026-81578) involving SQL injection, Java bytecode manipulation, web shell deployment, and AdaptixC2 command-and-control infrastructure in real-world attacks targeting internet-facing print servers.

Jake[verified]@inkmoroActive Exploitation

Intel reports real hands‑on exploitation of PaperCut NG/MF vulnerabilities, decrypting webshell and C2 comms, signaling active attacks in the wild.

Giuseppe `N3mes1s`[verified]@N3mes1sPoC

The tweet announces a proof‑of‑concept confirming Remote Code Execution for PaperCut CVE‑2026‑81578 and CVE‑2026‑82078, providing a link to the reproduction details and noting a newly discovered variant.

watchTowr[verified]@watchtowrcyberActive Exploitation

WatchTowr and PaperCut are addressing actively exploited zero‑day CVEs 2026‑81578 and 2026‑82078; patches are being iteratively released and users should treat the situation as an incident response trigger.

YBE[verified]@LumideezyActive Exploitation

Two PaperCut CVEs are being actively exploited for credential theft in schools and universities, so urgent patching is recommended.