PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

**PaperCut NG/MF pre-auth remote code execution (RCE) observed in the wild:** Huntress documents an active exploitation chain against PaperCut NG/MF (affecting multiple versions) that leverages an authorization bypass and unsafe dynamic class loading to achieve pre-auth RCE, dropping and executing Java .class payloads that run system discovery and delete logs; PaperCut has released emergency patches and assigned CVEs (CVE-2026-81578 and CVE-2026-82078).