CVE-2026-81578: PaperCut NG/MF Web Management Authentication Bypass

HERMES

HERMES THREAT SCORE & WEB INTERFACE ATTACK SURFACE

Target: PaperCut NG/MF Application Server (Web Management Interface)

Confidence: 99%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 18 / 20

Impact 18 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-81578 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score elevates operational risk to 94 (CRITICAL) due to active in-the-wild exploitation in the AI-orchestrated PaperCut campaign and CISA KEV listing.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-81578: PaperCut NG/MF Web Management Authentication BypassVULNERABILITY

Connected Nodes: 3

Active Relationships (Outgoing)

→ affectsPRODUCTPaperCut NG / MF Print Management

99% VERY_HIGH

Enterprise print management and document tracking platform deployed widely across education and corporate networks.

🔍 Why is this related? (Evidence & Provenance)

“Directly confirmed by PaperCut Security Bulletin and active exploitation in KEV.”

Supporting Verified Evidence:

• [telemetry]GreyNoise Global Observation Grid observed 440+ PaperCut instances exploited in seconds by hundreds of AI agents powered by OpenAI Codex and DeepSeek. — Source: GreyNoise Labs: Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF (Reliability: VERY_HIGH)

→ affectsPRODUCTPaperCut MF/NG

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in PaperCut MF/NG documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Inbound Associations (Incoming)

Agents Gone Wild: AI-Orchestrated Global Campaign Against PaperCut NG/MFCAMPAIGN → exploits → [This Entity]

99% VERY_HIGH

CISA KEV Alert: Active Exploitation in Autonomous AI Campaign

CVSS v3.1: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-306: Missing Authentication for Critical Function. Added to CISA KEV on August 31, 2026. Actively exploited as the initial authentication bypass stage in the global AI-Orchestrated PaperCut Campaign.

Executive Summary

CVE-2026-81578 affects PaperCut NG and MF versions prior to 24.1.10, 25.0.13, and 26.0.5. Due to improper access control enforcement in the web application framework, unauthenticated remote attackers can dispatch requests that trigger backend configuration modifications before session authorization filters are validated. When chained with CVE-2026-82078, this bypass yields full remote code execution under NT AUTHORITY\SYSTEM.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-81578	PaperCut Security Bulletin & CISA KEV Catalog
Affected Product	papercut:papercut_ng_mf	Print Management & Active Directory Integration Suite
Vulnerable Component	PaperCut Web Management Interface	Session Authentication Filter & Request Dispatcher
Weakness Class	CWE-306: Missing Authentication for Critical Function	Access Control Failure / Authentication Bypass
CVSS v3.1 Score	8.8 (HIGH / Hermes Score 94)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed Versions	24.1.10, 25.0.13, 26.0.5	Emergency Patch Release 3
MITRE ATT&CK	T1190 - Exploit Public-Facing Application, T1078 - Valid Accounts	Initial Access / Defense Evasion
Chained Threat Intel	AI-Orchestrated PaperCut Campaign	Exploited in 440+ enterprise intrusions

---

2. In-Depth Technical Decomposition & Root Cause

PaperCut utilizes an Apache Tapestry-based Java web servlet engine. Client requests are dispatched to page handlers via service URLs (e.g. /app?service=direct/...).

The security filter evaluated requests by inspecting the targeted page name. However, a logic flaw in URL path parsing and parameter extraction allowed incoming HTTP requests to manipulate internal session states:

// Vulnerable request filter logic in PaperCut Application Server
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
    HttpServletRequest req = (HttpServletRequest) request;
    String service = req.getParameter("service");

    // VULNERABILITY (CVE-2026-81578):
    // Direct service requests bypassed the authentication requirement check
    // if the target component matched specific internal setup or diagnostic endpoints
    if (service != null && service.startsWith("direct/") && isExemptService(service)) {
        // Invokes backend configuration update before verifying active admin session!
        dispatchDirectService(req, response);
        return;
    }

    // Standard session validation
    if (!isAuthenticated(req.getSession())) {
        redirectToLogin(response);
        return;
    }
    chain.doFilter(request, response);
}

By crafting direct service invocations, an unauthenticated attacker could overwrite persistent system properties, including database connection parameters and custom class handlers.

---

3. Attack Scenarios & Chained RCE Flow

1. Reconnaissance: Attacker scans for exposed PaperCut servers on TCP port 9191 (HTTP) or 9192 (HTTPS).
2. Authentication Bypass (CVE-2026-81578): Attacker issues an unauthenticated POST request to /app?service=direct/1/Home/$DirectLink with crafted parameters, updating the internal database driver configuration.
3. Code Execution Trigger (CVE-2026-82078): The updated database parameter instructs the application to dynamically load and reflect a malicious Java class.
4. Active Directory Pivoting: Because PaperCut runs as NT AUTHORITY\SYSTEM, the attacker extracts credentials to execute noPac (CVE-2021-42278 / CVE-2021-42287) or pass-the-hash to domain controllers.

---

4. Forensic Detection & System Telemetry

Server Log Analysis

Inspect [PaperCut-Dir]\server\logs\server.log for unauthenticated accesses: User [null] invoked administrative service [direct/...].

Process & File Artifacts

Check for test files in ...\server\custom\web\pcp_*.txt created during initial probe validation.

---

5. Remediation & Hardening Guidelines

1. Immediate Update: Upgrade PaperCut NG/MF to 24.1.10, 25.0.13, or 26.0.5.
2. Network Isolation: Restrict ports 9191 and 9192 to internal management VLANs. Never expose PaperCut web portals directly to the internet without a WAF or VPN.
3. Correlate with Campaign Intel: Read our strategic report on the AI-Orchestrated PaperCut Campaign.