PaperCut NG/MF Zero-Day: CVE-2026-81578, CVE-2026-82078 (Active Exploitation Underway)

Exploitation timelines have never felt shorter, with little more than a code diff, language from an advisory, or a high-confidence “rumor” of a bug often being enough to reverse, reproduce, weaponize, and exploit newly disclosed vulnerabilities given enough tokens.

The most recent PaperCut NG/MF vulnerabilities are no exception.

Days after the first patch was released, we observed a threat actor gain Remote Code Execution on one of our PaperCut honeypots, reconfiguring the server’s user-lookup connector, executing a payload entirely in memory, and restoring the configuration. All of it in under 5 seconds.

On August 27th, PaperCut published an urgent security advisory confirming active exploitation of zero-day vulnerabilities targeting PaperCut NG and MF instances, the print management platform used by a lot of education institutions, but also government, healthcare, and wider enterprise.

CVEs followed a day later (CVE-2026-81578 and CVE-2026-82078) alongside an emergency patch. A secondary emergency patch followed after the first was found to be bypassable by our own research at watchTowr Labs. Both vulnerabilities are now on CISA’s Known Exploited Vulnerabilities list.

Through Attacker Eye, our global honeypot network, we watched first-hand as activity escalated from benign fingerprinting, to mass scanning, to full exploitation, and eventually to a human operator reading files through a webshell.

We gained full visibility of one intrusion end-to-end. We watched the attacker fail to deploy their initial implant, fix the bug, iterate, and return an hour later and try again. Using our telemetry, we were able to extract the encryption keys from their webshells, and decrypt every command they sent through it.

This telemetry was used in near real time to build and continuously iterate on detection capabilities to hunt for vulnerable systems across client environments and to identify systems that have already been compromised.

If your PaperCut instance was exposed to the Internet and unpatched over the last few days, the assumption should be that it has been compromised.

IoCs are provided at the end of this post.

Vulnerability Overview

Before we dive into what attackers did, a brief recap of both of the relevant vulnerabilities:

• CVE-2026-81578 – An authentication bypass vulnerability due to PaperCut NG / MF’s use of the Apache Tapestry web framework, allowing an unauthenticated, external attacker to forge a URL that invokes sensitive administrative functionality (like ConfigEditor).
• CVE-2026-82078 – An authenticated remote code execution vulnerability due to PaperCut NG / MF’s external user-lookup database connector, which allows an attacker with configuration access (via CVE-2026-81578) to load and execute Java bytecode via a crafted JDBC connection URL, achieving code execution.

When chained together, an unauthenticated, external attacker can leverage both vulnerabilities to bypass authentication, modify the configuration of the PaperCut instance, and gain Remote Code Execution in the context of the PaperCut server process.

PaperCut is an extremely interesting target for attackers. It provides a foothold into a corporate network, but also by design a lot of sensitive data from printed documents including who printed what, when, and from where, and when the optional Print Archiving feature is enabled, the documents themselves.

What is watchTowr Intel observing?

Since the original advisory was published on August 27th, we have observed quite a lot of activity against our PaperCut honeypot sensors, which are real appliances deployed across a variety of infrastructure and geographies designed to capture real exploitation end-to-end.

Across our sensor network, we have seen behavior evolve from mass scanning to targeted exploitation by a small number of actors to hands-on-keyboard activity by a real human operator.

At the time of writing, we’ve captured over 1000 real attempts designed to exploit the PaperCut vulnerabilities across more than 10 unique geographies.

At a high level, we have seen the following:

• Mass scanning for the authentication bypass vulnerability across our entire global sensor network, targeting PaperCut instances across broad geographies.
• Successful exploitation of the full CVE-2026-81578 and CVE-2026-82078 exploit chain to gain Remote Code Execution using a H2 and Groovy technique.
• Post-exploitation deployment of in-memory implants registered as Jetty servlet filters, including a Godzilla C2 webshell, and a “suo5” HTTP proxy tunnel tool, deployed as a pair.
• Two deployment attempts against the same target, roughly an hour apart. The first failed due to a bug, and once fixed, the second succeeded.
• Active C2 communication with the deployed webshell from a separate source IP address and geography, shortly after the webshell was deployed.

Timeline

Timestamps have been slightly shifted by minor offsets to protect our sensor infrastructure. Publicly known dates are unchanged.

Initial Probes

Three days after the advisory was published, we observed the first exploitation attempts against our sensor network. However, we do believe that broader in-the-wild exploitation was already ongoing after the disclosure by PaperCut.

Most of the initial activity we saw was relatively benign, with both Internet-wide scanners and genuine attackers probing Internet-facing PaperCut NG / MF instances to validate the existence of the authentication bypass, and stop there.

Probes were designed to invoke either the UserList or ConfigEditor administrative components via the ?service=direct URL pattern, proving access to otherwise restricted functionality was possible:

GET /app?service=direct/1/Home/UserList/$QuickFind.$Form
GET /app?service=direct/1/Error/ConfigEditor/quickFindForm
GET /app?service=direct/0/LogonMessage/ConfigEditor/quickFindForm&sp=S1

At this time, we saw the total number of probes we were observing increase, suggesting that working knowledge of the vulnerabilities was very much in the public domain.

Our sensor network is made up of hundreds of unique appliances, and almost every exploitation attempt captured at first was targeted exclusively at PaperCut instances, with most attempts starting with an initial probe to /app?service=page/Home to first fingerprint and validate the existence of PaperCut NG / MF, grab a session, and only then exploit the vulnerability.

Active Exploitation

By the early hours of August 31st, observed activity escalated to full exploitation. We saw attackers successfully chain both CVE-2026-81578 and CVE-2026-82078 to gain Remote Code Execution on our PaperCut sensors.

Exploitation followed a sequence of POST requests designed to bypass authentication, reconfigure the database connector to execute Groovy code, trigger the vulnerability, and restore the configuration to default values.

Below are some of the HTTP requests we received, which can be used to grep through log files:

Authentication Bypass

POST /app?service=direct%2F0%2FLogonMessage%2FConfigEditor%2FquickFindForm&sp=S1
POST /app?service=direct/1/Home/UserList/$QuickFind.$Form

Configuration Overwrite

The ConfigEditor uses a two-step form, in which the configuration key and its new value are sent in separate requests.

First, the key is selected:

POST /app?service=direct%2F0%2FLogonMessage%2FConfigEditor%2FquickFindForm&sp=S1

$TextField=user-lookup.db-driver&doQuickFind=GO

Then, in a secondary request, the value is written:

POST /app?service=direct%2F0%2FLogonMessage%2FConfigEditor%2F%24Form&sp=S1

$TextField$0=org.h2.Driver&$Submit=GO

An attacker exploiting this vulnerability is likely to modify the following keys to gain Remote Code Execution:

• user-lookup.db-driver
• user-lookup.db-url
• user-lookup.id-to-username-sql
• user-lookup.enabled

Payload Trigger

POST /app?service=direct%2F0%2FLogonMessage%2FUserList%2F%24QuickFind.%24Form&sp=S1

In the instance we observed, the POST body was a huge base64-encoded Java class. This can be hunted for by looking for the following (encoded):

• %24TextField=def+b64+%3D+%27yv66vg

Decoded, this is $TextField=def b64 = 'yv66vg. The string yv66vg is base64 for 0xCAFEBABE, the magic bytes seen at the start of a Java class file.

Post-Exploitation

After gaining code execution in one particular case, a threat actor dropped in-memory implants, including Godzilla C2 webshells and “suo5” HTTP proxy tunnels.

Both were deployed as servlet filters, designed to intercept inbound HTTP requests and operate entirely out of memory with nothing written to disk, persisting until the PaperCut service is restarted.

Godzilla is a well-known, feature-rich backdoor used by both commodity and motivated threat actors. It provides an attacker with a fully interactive C2 channel with file access, command execution, and the ability to deploy additional plugins.

suo5 is another public and open-source HTTP tunneling proxy. It provides an attacker with the ability to route traffic from the Internet through PaperCut towards the internal network.

We observed two attempts at exploitation, roughly one hour apart, from the same threat actor. Each wave carried both Godzilla and suo5 as a pair. The first attempt failed to install and the second attempt was successful.

Both attempts originated from the same source IP address, with both the password and AES key used changing on each attempt.

The AES keys are 16-character strings (16 bytes, 128 bits) that are used directly as key bytes.

We saw the actor discover the deployment failure in real time, when 20 seconds after delivering the loader for their first attempt they attempted to interact with suo5, but failed.

After fixing and debugging, 52 minutes later we saw the second attempt arrive. An identical loader with a fresh payload was used to successfully deploy both implants.

The usage of suo5 is extremely interesting, as it turns the PaperCut server into a HTTP tunneling proxy, giving an attacker a route from the Internet to the internal corporate network.

An attacker does not typically deploy a SOCKS proxy alongside a webshell unless they have an intention to use it and reach further in. We suspect their objectives extended well beyond just the PaperCut server itself.

Hands-on-Keyboard

Eighteen seconds after the second wave was deployed on our PaperCut instance, a new and separate IP address began interacting with the deployed Godzilla webshell, using the correct AES key and password.

Using our telemetry and knowledge of the configured AES key, we were able to decrypt all traffic between the operator and the webshell, reconstructing a timeline of the operator’s actions reflecting a real, hands-on-keyboard attacker.

Sifting through produced event logs can be extremely interesting, and in many cases the absence of activity is just as interesting as what the attacker is actually doing. The gaps between the operator’s actions are quite revealing, as they pause to read output before performing the next action.

The operator connected from a different IP address after deploying the webshell, consistent with the attacker using different infrastructure for exploitation and C2.

We suspect the non-standard presence of the Docker files in the root filesystem spooked the operator and burned the honeypot, so unfortunately, this is where the story ends for now.

Recommendations

As part of releasing this blog post, we’re hoping to enable as many security teams as possible to effectively hunt across their environment and PaperCut instances for indicators of compromise.

It is recommended to:

• Assume any unpatched PaperCut instance exposed to the Internet is compromised.
• Capture forensic evidence before restarting. The webshells we observed are deployed entirely in memory as servlet filters, and a restart will destroy them. Ensure a heap dump or memory capture is taken of the running JVM process, and application / web server logs are preserved.
• Patch immediately. Upgrade PaperCut NG/MF to the latest version and emergency patch, addressing CVE-2026-81578, CVE-2026-82078, and bypasses.
• Restart the PaperCut application service. Once forensic evidence has been captured, restart the service to remove in-memory implants. Patching alone does not remove an existing shell.
• Review web server and application logs for URI patterns and POST body indicators listed below, looking for any requests targeting ConfigEditor or UserList components.
• Check the database connector configuration. Successful exploitation modifies user-lookup related keys, and may not always reset them to the default.
• Audit servlet filters. If you have visibility of the running JVM, look for registered filters whose classes do not belong to PaperCut or Jetty. The implants we observed impersonated Jetty, registering under org.eclipse.jetty.servlet.handlers.<random>.<Name>JakartaFilter.
• Look for impersonated Tomcat classes if you have visibility. The Godzilla C2 operator loaded helper classes under org.apache.coyote.*, which are anomalous for PaperCut.

IoCs

We’re including a collection of IoCs observed across our sensors to help defenders evaluate systems for signs of compromise. Naturally, many indicators may be transient, like IP addresses, credentials, and class names, but the underlying behavioral patterns are likely to be consistent.

Godzilla C2 Indicators

The main indicator seen across our sensors was HTTP requests featuring the X-Ms-Party header and a static value likely consistent with the actor’s builder.

Exploitation URI Patterns

As a starting point, any request containing service=direct in combination with ConfigEditor or UserList should be treated as highly suspicious.

GET /app?service=direct/1/Home/UserList/$QuickFind.$Form
POST /app?service=direct%2F0%2FLogonMessage%2FConfigEditor%2FquickFindForm&sp=S1
POST /app?service=direct%2F0%2FLogonMessage%2FConfigEditor%2F%24Form&sp=S1
POST /app?service=direct%2F0%2FLogonMessage%2FUserList%2F%24QuickFind.%24Form&sp=S1

POST Body Indicators

Successful exploitation is reliant on modifying the database connector. If you have visibility, hunt for POST bodies containing the following:

Network Indicators

Webshell Servlet Filter Classes

Deployed webshells were registered as Jetty servlet filters under randomly generated names, following a structure of org.eclipse.jetty.servlet.handlers.<random>.<Name>JakartaFilter:

The random names are unique per deployment, but the underlying pattern is likely to be consistent. Classes under org.eclipse.jetty.servlet.handlers with a short random subdirectory, and name ending in JakartaFilter.

This can be hunted for in heap dumps or memory captures obtained from PaperCut appliances.

Godzilla Class Loads

The following Java classes were loaded into the JVM by the C2 operator during the captured hands-on-keyboard interactions. These are likely to differ between intrusion campaigns, but are included for completeness.

• org.apache.coyote.deser.BeanDeserializerBase
• org.apache.coyote.deser.impl.UnwrappedPropertyHandler
• org.apache.coyote.util.Converter
• org.apache.coyote.cfg.MapperConfigBase

suo5 Tunnel Indicators

This analysis was published by watchTowr Intel, the threat intelligence layer of the watchTowr Platform, our Preemptive Exposure Management solution built to help enterprise organizations outpace attackers.

By combining Proactive Threat Intelligence with External Attack Surface Management and Autonomous Mitigation, watchTowr continuously identifies, validates and mitigates real exposure, so security teams can outrun real-world threats.

Learn how the watchTowr Platform helps organizations outpace attackers and gain time to respond.