PaperCut issues emergency patches for exploited zero-day vulnerabilities

PaperCut has issued emergency patches for its NG and MF print-management platforms following the discovery of a critical zero-day vulnerability chain being actively exploited in the wild. The flaws, identified as CVE-2026-81578 and CVE-2026-82078, allow unauthenticated remote attackers to bypass authentication and execute arbitrary Java bytecode, potentially leading to full server compromise.

Security researchers from Huntress and watchTowr successfully reproduced the exploit and discovered that initial patches were susceptible to bypasses, necessitating a second wave of emergency updates. The vulnerabilities pose a high risk to organizations, including schools and government agencies, particularly those with application servers exposed to the public internet.

CISA has added these vulnerabilities to its Known Exploited Vulnerabilities Catalog. Meanwhile, Rapid7’s Metasploit Framework is adding an exploit module to assist authorized defenders in identifying vulnerable instances. Experts urge users to restrict access to PaperCut servers to trusted internal networks and to apply the latest security updates immediately.