Twenty seven minutes from hello to remote access

A vendor saying the quiet part out loud#

PaperCut's security bulletin of 27 August 2026 does not hedge. Its own words: the security response team "is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF", and "We are aware of confirmed customer incidents and are treating this matter with the highest priority".

Then the sentence most vendors would have buried. Asked in its own FAQ whether the emergency patch is an official release, PaperCut answers: "No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action."

That is unusually straight, and it is the right call. A patch shipped outside the normal process carries different risk, and customers deciding whether to apply it at speed need to know. Any vulnerability management programme runs on exactly this sort of candour from suppliers, and gets it far too rarely.

Two identifiers are public. CVE-2026-82078 is unsafe dynamic class loading in the database connector, rated 9.4 critical. CVE-2026-81578 is an authentication bypass in the web management interface, rated 8.8, where unauthenticated remote requests to administrative functions can trigger backend actions before access validation finishes.

Read the vectors together and the chain appears. The 9.4 requires high privileges. The 8.8 requires none and lets an attacker modify system configuration. Chained, a zero day vulnerability that looks gated on paper stops being gated in practice.

The weakness classes are worth naming because they are ordinary. The first is CWE-470, unsafe reflection: the application instantiates database driver classes from configurable names without validating them. The second is CWE-306, missing authentication for a critical function. Neither is exotic, and both are the sort of thing a vulnerability management programme is supposed to be built for.

Severity scoring treats each flaw as a separate event, which is how a pair like this slips through triage. A team ranking by score alone patches the 9.4 and schedules the 8.8, when in fact the authentication bypass is the one that opens the door. Chain-aware vulnerability management is the difference between fixing a lock and fixing the way in.

Vulnerability management against a published clock#

PaperCut did something genuinely useful: it published the observed attacker command sequence, timed as elapsed time from the first command rather than wall-clock time. Very few advisories give defenders a stopwatch.

The sequence itself reads like a checklist. It opens with the process launching a shell and running a basic identity and version check, moves to a process list, then a domain controller lookup, then logged-on users and the contents of the users directory. Sixteen minutes in, a remote access installer is pulled down. At twenty one and a half minutes a Windows service named "Remote Access Service" is installed, running as LocalSystem and set to start automatically.

PaperCut publishes indicators of compromise alongside it, then adds the caveat that separates useful guidance from reassurance: "The absence of the above indicators is not confirmation that a system has not been affected." Attackers tidy up. A clean scan is not an all-clear.

For anyone selling vulnerability management software, this is the honest benchmark to hold your product against. Not how many findings it lists, but whether it would have surfaced a shell spawning from a print server inside twenty minutes.

Why the patch-now list did not carry it#

Plenty of organisations drive remediation from CISA's Known Exploited Vulnerabilities catalogue, on the reasonable theory that confirmed exploitation is the best prioritisation signal available. It is a good list. It is not a complete one.

Here is a vulnerability the vendor itself describes as under active exploitation with confirmed customer incidents, and a programme keyed solely to that published feed would not have raised a ticket at the point the bulletin went up. The catalogue is a lagging indicator by construction, because an entry requires evidence to be collected, verified and published.

The practical consequence is a gap of hours or days in exactly the window that matters, and it falls on whoever is doing vulnerability management to close it by hand. Vendor advisories, not just aggregated feeds, need to be a monitored input.

None of that is a criticism of the catalogue, which does exactly what it says. It is a criticism of using one input as a whole strategy. Good vulnerability management reads the vendor's own advisory feed as a first-class source, not as background noise to be reconciled later.

PaperCut carries history here that sharpens the point. A different flaw in the same product family, CVE-2023-27350, became a mass exploitation event in 2023. A print management server is a soft-sounding thing that sits deep inside a network with broad reach, which is precisely why it keeps being chosen.

What the company's own front door said#

One detail is worth recording plainly, because it is a communications lesson rather than a technical one. Three days into a confirmed, actively exploited flaw, papercut.com did not carry a visible site-wide alert pointing at the current bulletin.

The page does contain an alert bar element. It is served hidden, and its link points at an advisory from March 2023 rather than the live one. The route to the current bulletin is a card in a "What's new" grid partway down the homepage, under a header strip promoting a cloud printing guide.

Set that beside the bulletin itself and the contrast is stark. The security team is publishing attacker command sequences, defanged URLs and honest caveats, at speed, over four days. The homepage is running business as usual. Those are two different companies talking to two different audiences, and only one of them knows there is a hunt on.

It is worth being precise about what this does and does not show. A hidden alert bar is a content management oversight, not negligence, and the security team is plainly working hard and publishing fast. But a customer arriving at the homepage during an active exploitation event is the exact person the alert bar exists for, and vulnerability management inside customer organisations often starts with somebody checking a vendor's front page.

The lesson generalises well beyond printing software. When something is on fire, the fastest-moving truth in the organisation is usually sitting in a technical document that marketing does not own and has not linked. Closing that gap costs nothing and is worth more than any statement.

Credit where it is due on the response itself: PaperCut names Huntress and watchTowr for hardening the second emergency patch, and tells customers to install Release 2 even if they already applied the first. Naming outside researchers in the middle of an incident is a confidence signal, not a weakness.

Five moves while the trail is still warm#

The advisory applies to all versions of both products, and the guidance is explicit that Site Servers and secondary print servers need updating too, not just the primary application server. Half-patched estates are how this recurs.

There is one more reason to move now rather than at the next change window. The hunt is running in the open: the vendor is publishing, researchers are publishing, and every hour that passes narrows the gap between the people reading the bulletin to defend and the people reading it for targeting. That asymmetry is why vulnerability management companies sell urgency, and this week it happens to be real.

One last framing for anyone whose vulnerability management programme is judged on numbers. A dashboard showing a falling count of open findings tells you almost nothing about this incident. The only figure that would have mattered on the night is how long it took somebody to notice a shell spawning from a print server, and almost nobody reports that one.

Print servers are the undergrowth of a network: unglamorous, everywhere, and rarely watched. The vixen goes where the watching is thinnest, and so does everybody else. Follow the trail into the undergrowth, patch the quiet things first, and keep a paw on the clock, which is the same argument folkfox makes across our cybersecurity work.

Frequently asked questions#