Overview
- PaperCut confirmed active exploitation and customer incidents after researchers and vendors found attackers could use an authentication bypass (CVE-2026-81578) chained with unsafe dynamic class loading (CVE-2026-82078) to run arbitrary Java code on Application Servers.
- PaperCut released Emergency Patch Release 2 for supported versions Friday after external teams discovered multiple ways the initial emergency fix could be bypassed and worked with the vendor to harden the update.
- Observed post‑exploit behavior includes pc-app.exe spawning system commands, deployment of attacker Java .class payloads that fingerprint hosts and list files, and deletion or truncation of server.log and derby.log files, all of which are included in PaperCut’s published IoCs.
- Roughly 1,000 PaperCut Application Servers are publicly reachable on the internet, mainly in North America and Europe, which raises risk because a single exposed server can give attackers a high‑value pivot into internal networks.
- PaperCut and researchers urge immediate action: install Release 2, remove public internet exposure or place management interfaces behind VPNs, preserve logs for forensics, and hunt for the published indicators such as the listed error strings and pc-app.exe spawning whoami, ver, or tasklist.