More Details Emerge on Exploited PaperCut Vulnerabilities

What happened

PaperCut has issued a second emergency patch addressing two actively exploited vulnerabilities now formally tracked as CVE-2026-82078 and CVE-2026-81578. The flaws were discovered being exploited in the wild before the patches were available, prompting the company to move quickly on an out-of-cycle release cycle after an initial emergency fix proved insufficient to fully close the attack surface.

This article covers the technical significance of both CVEs, what the second patch changes for organizations already running PaperCut, how administrators should approach installation or upgrade, and what edge cases or compatibility concerns deserve attention before applying the fix. It is written for security engineers, system administrators, and developers responsible for managing or integrating PaperCut deployments.

PaperCut released a second emergency patch targeting CVE-2026-82078 and CVE-2026-81578, both of which were under active exploitation at the time of disclosure. The designation of a second emergency patch indicates that the first remediation attempt did not fully neutralize the vulnerabilities, and that threat actors were continuing to exploit one or both flaws against unpatched or partially patched installations. Emergency patches in this sequence are rare and signal that the underlying issue had more surface area than initial triage identified.

How it works

The two CVEs are tracked separately, meaning they represent distinct vulnerability classes or distinct attack vectors even if they share a common exploitation context. PaperCut has not yet made its full technical advisory public according to the summary available, but the fact that both identifiers carry 2026 assignment dates places this disclosure firmly in an active threat window. Organizations should treat the second patch as the authoritative remediation and not assume the first patch provided adequate protection.

Developers and platform teams embedding PaperCut into print management workflows, cloud provisioning pipelines, or managed service offerings need to assess whether their integration layer could have been touched by these vulnerabilities between the first and second patch release. If your stack calls PaperCut APIs, proxies requests to PaperCut services, or relies on PaperCut's authentication or job-management subsystems, you should audit those integration points for any anomalous activity during the window when exploitation was confirmed active.

Why it matters

The separate CVE identifiers suggest that the two vulnerabilities may affect different components of the PaperCut platform. Builders who have customized PaperCut's server-side configuration or extended it through scripting interfaces should pay particular attention to whether those customization surfaces are covered by the second patch's changelog when PaperCut publishes full disclosure details. Do not assume a component you have customized is safe simply because it was not mentioned in the initial advisory.

Administrators should obtain the second emergency patch directly from PaperCut's official download channels and apply it to all PaperCut NG and PaperCut MF instances, as both product lines are typically affected when PaperCut issues emergency security releases. Because a first patch was already distributed, environments that applied it should not assume they are protected and must apply the second patch as a distinct update step, not a delta or incremental rollup that was automatically distributed.

Before applying the patch in production, test in a staging environment where possible, paying close attention to any print queues, user authentication flows, or scheduled job configurations that rely on the components the patch addresses. After applying the patch, verify the installed build number matches the version PaperCut designates as the remediated release, and confirm that no unauthorized configuration changes occurred during the active exploitation window that would persist even after patching.

Who is affected

Organizations that staged the first emergency patch but have not yet fully rolled it out face a compounded update problem: they may need to evaluate whether to skip the first patch entirely and apply only the second, or whether the second patch requires the first as a prerequisite. PaperCut's release notes for the second patch should clarify this sequencing, and administrators should not proceed without confirming that dependency before touching production systems.

Environments with PaperCut instances behind reverse proxies, load balancers, or with non-standard port configurations should verify that network-layer controls have not been silently bypassed during the exploitation window. CVEs with active exploitation histories sometimes indicate that attackers used pre-authentication or network-adjacent attack paths that firewalls alone cannot block, meaning perimeter controls are not a substitute for applying the patch and reviewing access logs for indicators of compromise tied to CVE-2026-82078 and CVE-2026-81578.

What to watch next

PaperCut has not yet published a complete technical advisory at the time of this writing, so the precise vulnerability mechanisms behind CVE-2026-82078 and CVE-2026-81578 remain undisclosed publicly. When that advisory drops, administrators should review it for CVSS scores, attack vector classifications, and any proof-of-concept details that threat intelligence teams can use to build detection rules or audit historical log data for retroactive compromise indicators.

The pattern of a second emergency patch following a first suggests that security researchers or the responding incident teams found additional attack paths during post-exploitation forensics. Watch for supplementary advisories, updated indicators of compromise from threat intelligence vendors, and any PaperCut security bulletins that may expand the scope of affected versions beyond what the initial emergency releases covered.