CVE-2026-81578, CVE-2026-82078

Critical

Emerging Threat · 28 Aug 2026

Validate Your Exposure to PaperCut NF/MG CVE-2026-81578 and CVE-2026-82078

At a glance

We can rapidly deploy the zero-install watchTowr Platform to determine if your organization is affected by CVE-2026-81578 and CVE-2026-82078.

The watchTowr Platform is trusted within the world’s most targeted industries, to help protect their attack surfaces.

CVSS

9.4 (v4.0)

Exploitation

In The Wild

CISA KEV

Listed

Vendor patch

Available

watchTowr check

Live

Rapid support

Find Out If You’re Affected

We onboard from outside, assess your exposure to this CVE, and come back with a validated answer, not a maybe.

Zero install · no infrastructure changes

Deployed and assessing within hours

How we answer it

Hour 0

You give us a domain. Nothing to install, no infrastructure change.

Hours

We reconstruct your external estate and locate every exposed instance an attacker could reach.

Same Day

You get a validated answer on exposure, and mitigation options if you cannot patch immediately.

What Teams Ask Us First?

PaperCut NG and MF Application Servers on versions 24, 25 and 26 are affected unless they run Emergency Patch Release 3 or the 10 September 2026 maintenance releases (26.0.5, 25.0.13 or 24.1.10); version 23 and earlier are affected and have no patch. Emergency patch builds report the same version number as the unpatched release they were based on, so confirm which patch level you actually installed.
Yes. PaperCut confirmed active exploitation of unpatched servers when it published the bulletin on 27 August 2026, and Emergency Patch Release 3 closed further attack vectors PaperCut observed being exploited in the wild. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 31 August 2026 with a 14 September 2026 remediation deadline. watchTowr worked with PaperCut on bypasses of the first emergency patch.
Upgrade Application Servers to 26.0.5, 25.0.13 or 24.1.10 (or, at minimum, Emergency Patch Release 3); if you are on Release 1 or 2, upgrade now. Until patched, restrict web access to the Application Server to trusted IP addresses only, and review PaperCut’s indicators of compromise, including suspicious post-exploitation activity from pc-app.exe. watchTowr can validate your exposure from outside, with nothing more than your domain.
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.