CVE-2026-81578: Exploited PaperCut Authentication Bypass Chains to Pre-Auth RCE
ID: 982a30d0-ce69-56b7-bc8e-a894ce258224
STIX ID: report--982a30d0-ce69-56b7-bc8e-a894ce258224
Feed Name: SOC Prime Blog
Threat Score
PaperCut NG and MF are being actively exploited via two chained zero-day flaws—CVE-2026-81578 (pre-auth authentication bypass) and CVE-2026-82078 (unsafe dynamic Java class loading)—that enable unauthenticated remote code execution as SYSTEM; Huntress observed exploitation beginning August 26, 2026, a public PoC and CISA KEV listing exist, and PaperCut has released Emergency Patch Release 3 plus mitigation and forensic guidance for impacted deployments.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.