PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit

A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut:

• CVE-2026-81578 — Missing Authentication for Critical Function (CWE-306). A remote unauthenticated request can trigger an administrative backend action before access validation completes.
• CVE-2026-82078 — Unsafe Dynamic Class Loading. A database connection utility can instantiate a driver class from a configurable name without an allowlist → arbitrary Java bytecode execution → host command execution (CVSS 9.4 Critical).

When chained: Internet → no auth → config manipulation → unsafe class loading → arbitrary Java execution → host command execution.

What's inside

Deep detection features

The scanner goes beyond version checking. It detects the actual attack artifacts observed in the wild (Huntress / PaperCut advisory):

1. Version — compares build against safe versions (< 24.1.10, < 25.0.13, < 26.0.5).
2. Web exposure — non-destructive probe of the PaperCut web interface.
3. IOC payload scan (--log) — detects attacker artifacts in server.log:
   • jdbc:derby:memory:pwn (Derby memory DB used in the gadget chain)
   • No suitable driver found for jdbc:no:x
   • database error looking up cardID
   • base64-encoded recon commands (whoami & ver, whoami & ver & tasklist)
4. Config anomaly scan (--config) — flags attacker-modified external user-lookup settings:
   • non-allowlisted driver class names
   • suspicious JDBC URLs (jdbc:h2, )

Usage

# Check web exposure of a PaperCut server (non-destructive)
python3 papercut-exposure-checker.py --url https://print.server:9191

# Evaluate a build version against patched builds
python3 papercut-exposure-checker.py --version 25.0.11.75758

# Scan a server log for published IOCs (payload artifacts)
python3 papercut-exposure-checker.py --log /usr/local/papercut/server/logs/server.log

# Scan config file for attacker-modified user-lookup settings
python3 papercut-exposure-checker.py --config /usr/local/papercut/server/server.properties

# Scan lib dir for dropped .class payloads
python3 papercut-exposure-checker.py --lib /usr/local/papercut/server/lib

# Full deep scan + HTML/JSON reports
python3 papercut-exposure-checker.py \
  --url https://print.server:9191 \
  --version 25.0.11.75758 \
  --log /usr/local/papercut/server/logs/server.log \
  --config /usr/local/papercut/server/server.properties \
  --lib /usr/local/papercut/server/lib \
  --html report.html --json report.json

Important facts & mitigations

• Patch Release 1 is NOT enough. PaperCut published Emergency Patch Release 2 on 28 Aug 2026 with additional hardening. Customers must install Release 2 even if they already installed the first emergency patch.
• Release 2 available for: PaperCut NG and MF v24, v25, v26 on Windows, Linux, macOS.
• All versions affected: the advisory applies to all PaperCut NG and MF versions; older installs outside patched branches should not be considered safe.
• Active exploitation observed: Huntress reported exploitation in two customer environments (primarily system discovery so far).
• Immediate mitigation: if the PaperCut Application Server is publicly reachable, restrict the web interface to trusted IPs/networks using a firewall or network ACL — even before patching.

Published IOC to check

• Unusual pc-app.exe activity (post-exploitation)
• server.log missing, truncated, or deleted
• Abnormal DB errors: No suitable driver found, specific CardID lookup errors

Note: Absence of IOCs does NOT prove a server is clean.

Important disclaimer

This toolkit is defensive only. It does not exploit anything and should be used only on servers you are authorized to test. The prevention reference shows correct/secure code patterns for learning and hardening — never for attacking.

Before production use, verify the exact Emergency Patch Release 2 build numbers from the vendor advisory and update PATCHED_BUILDS in the scanner (placeholder values are used).