PaperCut MF Vulnerability Chain Enables Remote Code Execution Without Authentication

watchTowr Labs published details on a pre-authenticated remote code execution chain affecting PaperCut software on March 2026. The research team assigned identifiers WT-2026-0141 through WT-2026-0144 to the specific flaws discovered during their analysis. These vulnerabilities allow an attacker to execute arbitrary commands on a target system without providing valid user credentials or bypassing initial authentication gates. The disclosure highlights how multiple distinct issues can be combined to create a severe security risk for organizations relying on this print management infrastructure.

Root cause

The core issue stems from how PaperCut handled multiple security flaws and subsequent patch bypasses. According to the watchTowr Labs report, PaperCut assigned fewer CVE identifiers than the actual number of underlying vulnerabilities existed. This bundling approach made tracking individual flaws more complex for security researchers. The watchTowr team noted that the vendor combined distinct vulnerabilities and the methods used to bypass patches for those same vulnerabilities into single CVE IDs. This consolidation created confusion in the security community regarding the scope and nature of the threats.

Attack path

Attackers can exploit the sequence of flaws to achieve full remote code execution. The chain begins with an unauthenticated request to the vulnerable PaperCut service. By leveraging the specific interactions between the identified vulnerabilities, an adversary can bypass security controls intended to restrict access. The watchTowr Labs findings indicate that the path does not require initial user login. This pre-authenticated nature means that any individual with network access to the PaperCut server can potentially trigger the exploit chain. The combination of these flaws effectively negates standard authentication barriers.

Affected versions

The vulnerabilities apply to PaperCut software products that were released before the vendor issued the relevant patches. The watchTowr Labs publication does not list specific version numbers in the provided summary text. However, the existence of CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578 indicates that specific releases of PaperCut MF or NG were susceptible. Organizations should check their current software versions against the vendor's advisory to determine if their installation falls within the affected range. The lack of explicit versioning in the summary requires users to consult the full vendor disclosure.

Mitigation

• Apply the latest security updates provided by PaperCut to address the identified CVEs.
• Monitor network traffic for unusual outbound connections from print servers.
• Restrict external access to PaperCut management interfaces using firewall rules.
• Verify that all components of the print management suite are up to date.

What to do and how to stay safe: PaperCut

• Check your PaperCut software version against the vendor's latest security advisories.
• Ensure your network firewall blocks unnecessary external access to print management ports.
• Monitor server logs for signs of unauthorized command execution or strange process activity.
• Plan to apply vendor patches immediately once they are released for your specific version.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs associated with these PaperCut vulnerabilities?

The vulnerabilities are tracked under CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.

Does this exploit require a user to log in first?

No, the watchTowr Labs report describes this as a pre-authenticated remote code execution chain.

Why are there more watchTowr IDs than CVE IDs?

PaperCut bundled multiple vulnerabilities and their patch bypasses into fewer CVE identifiers.