PaperCut NG/MF Zero-Day Enables Unauthenticated Java RCE in Active Exploitation

The vendor confirmed customer compromises and released fixes without a CVE at disclosure. Indicators include anomalous pc-app.exe behavior and truncated or deleted server.log files used to erase traces. Roughly 1,000 instances remain internet-exposed, concentrated in North America and Europe per Shadowserver data. Prior PaperCut flaws already appear in CISA’s KEV catalog after ransomware use.

Huntress reporting shows the flaw lets attackers modify trusted configuration to run Java payloads without credentials. This matches patterns seen in other print-management and document-workflow products where initial access leads to domain pivots. Two earlier CVEs in the same product line were weaponized for ransomware; the current incident continues that targeting sequence.

Official statements omit actor attribution and technical proof-of-concept details. Independent telemetry from Huntress and Shadowserver supplies the concrete exposure and execution path evidence that vendor advisories withheld. The combination of public-facing instances and log tampering points to deliberate operational security by the operators rather than opportunistic scanning.

CISA is expected to evaluate KEV inclusion once the assigned identifiers CVE-2026-81578 and CVE-2026-82078 propagate. Organizations should isolate PaperCut servers from direct internet access and monitor for Java process anomalies within the next 14 days.