Unauthenticated configuration change chained to pre-auth RCE in PaperCut NG/MF (CVE-2026-81578)
Hunt.io's 2026-10-15 report documented the attacker's exploit code and victims across 45+ countries, and a Metasploit module now exists, so any PaperCut NG/MF server still below the fixed builds should be treated as a target already being scanned for.
An admin-only Tapestry component in the PaperCut NG/MF web interface can be reached without authentication, letting a remote attacker modify system configuration. Chained with CVE-2026-82078 this gives unauthenticated remote code execution on the PaperCut application server, and PaperCut has confirmed customer incidents.
Affected: PaperCut NG/MF < 24.1.10; PaperCut NG/MF 25.0.0 – 25.0.12; PaperCut NG/MF 26.0.0 – 26.0.4 (including Emergency Patch Release 1–3 builds, which are superseded)
How to Test
Check the installed version in the PaperCut NG/MF admin interface: anything below 24.1.10, 25.0.13 or 26.0.5 is affected unless Emergency Patch Release 3 was applied, which PaperCut says protects against these issues; emergency patch builds report the unpatched version number. Review the application server's web access logs for unauthenticated requests reaching admin-only Tapestry component paths and look for configuration changes in the admin audit log that staff did not make; the Huntress, GreyNoise and Hunt.io reports list observed post-exploitation activity to compare against.
How to Patch
Upgrade to PaperCut NG/MF 26.0.5, 25.0.13 or 24.1.10 via the standard upgrade procedure; these maintenance releases replace Emergency Patch Releases 1, 2 and 3, so hosts on an emergency patch build must also move to a maintenance release. Until upgraded, restrict network access to the application server's web interface to trusted addresses.