PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and PaperCut MF print management software. The update comes after researchers at watchTowr and Huntress discovered multiple ways to bypass the initial emergency patch released on August 27. PaperCut is now recommending all customers install the second version of the emergency patch — even those who already applied the first one.
The two flaws work together in a dangerous chain. CVE-2026-81578 (CVSS 8.8) is an improper access control vulnerability in PaperCut’s web management interface that allows an attacker to bypass authentication entirely. Once inside, they can edit a configuration file to trigger CVE-2026-82078 (CVSS 9.4), an unsafe dynamic class loading flaw in the database connection utilities that leads to remote code execution. Attackers do not need valid credentials to pull off this chain. Exploitation has been confirmed in the wild, with PaperCut reporting incidents at customer sites. The researchers noted that additional bypass paths against the fully patched version are still being analyzed, meaning further hardening updates may follow.
How to check if you’re affected
Affected versions are all releases of PaperCut NG and PaperCut MF prior to the Emergency Patch Release 2 issued on August 28, 2026. Any organization running an internet-exposed PaperCut Application Server with an older version should apply the second emergency patch immediately. If patching cannot happen right away, PaperCut recommends restricting access to the web management interface to trusted IP addresses using firewall rules or network access controls. Organizations that applied the original August 27 patch are not protected against all known bypass paths and must upgrade to Release 2.