PaperCut's Third Patch Failed Too: Inside the Chain That Forced a Mandatory 26.0.5 Upgrade
Original illustration created for Cyber Security Briefing.
watchTowr Labs disclosed on October 9, 2026, that PaperCut's own patches for NG versions 26.0.3 and 26.0.4 could still be bypassed to regain unauthenticated remote code execution, chaining three vulnerabilities the firm tracks as WT-2026-0141-0144. That finding landed more than six weeks after the vendor first scrambled to fix a zero-day under active exploitation, and four days before PaperCut's own September 2026 security bulletin, published October 13, conceded that 26.0.3 and 26.0.4 "remained vulnerable to certain exploit paths."
For print infrastructure that most security teams treat as background noise, that is three distinct failed remediation cycles on the same flaw family inside two months.
Three bugs, one working exploit
The chain watchTowr documented combines an authentication bypass in the Apache Tapestry framework underlying PaperCut's web management interface (CVE-2026-81578), unsafe dynamic class loading in the database connector (CVE-2026-82078), and path traversal in the Scan-to-Fax component (CVE-2026-82077). The National Vulnerability Database scored CVE-2026-81578 a CVSS 4.0 rating of 8.8 on August 28, 2026, describing it as improper access control that lets an unauthenticated remote attacker trigger backend configuration actions before access validation completes.
CVE-2026-82078 is the pivot that turns access into execution. SentinelOne's analysis of CVE-2026-82077, published September 24, 2026, adds the third leg: the Scan-to-Fax component fails to canonicalize administrator-supplied path values, letting an attacker inject traversal sequences that point the application at an attacker-controlled binary. Because PaperCut services commonly run with elevated privileges, SentinelOne notes, that traversal converts directly into host compromise.
watchTowr's report frames the underlying failure as strategic rather than purely technical: PaperCut's "fix-first" approach patched the specific request paths researchers reported without accounting for alternative logic paths through the same web management interface. Each round of patching closed one door into the Tapestry-based admin panel while leaving others reachable.
From zero-day to third bypass in six weeks
The chain's origin traces to 9:42 a.m. on August 27, 2026, when, according to PaperCut CEO Chris Dance's account published September 1, an education-sector customer reported anomalous activity. Dance confirms the company declared a P0 incident after logs showed genuine code execution on a server that was already fully patched, which meant the team was looking at a zero-day rather than an unpatched known flaw. PaperCut shipped emergency fixes within 24 hours of that declaration, Dance's account states.
Huntress had independently found the same hole. Researchers John Hammond and Andrew Brandt, in an August 27, 2026 writeup, described how a specifically crafted request could confuse PaperCut's authorization check by referencing one page for rendering while executing a component drawn from another page entirely — a logic flaw that let unauthenticated attackers rewrite server configuration outright. Hammond described the resulting compromise as "point and shoot": no credentials, no foothold required, just a target IP address.
That first emergency patch did not hold. Cybersecurity Dive's David Jones reported on August 31, 2026, that PaperCut had issued a second round of emergency patches after Huntress found a bypass against the initial fix, and that the exploit still required no username or password. The Cybersecurity Dive report also flagged the specific exposure pattern driving active attacks: higher-education and enterprise environments that leave print servers reachable from the open internet. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog that same day, August 31, according to SonicWall Capture Labs' September 16, 2026 analysis, which classified the flaws under CWE-306 (missing authentication for critical function) and CWE-470 (unsafe reflection) and confirmed the combined chain affected all PaperCut NG/MF releases before 24.1.10, 25.0.13 and 26.0.5.
PaperCut's own vulnerability log, updated September 24, 2026, describes the entire sequence as an "urgent" response cycle triggered by reports of active exploitation in late August, with resolution landing in version 26.0.5. Then came watchTowr's October 9 disclosure that 26.0.3 and 26.0.4 — the interim releases customers had been told closed the hole — still permitted the full unauthenticated chain, nearly six weeks after the August 31 second emergency patch. PaperCut's October 13 bulletin followed within days, formally mandating the upgrade to 26.0.5 and acknowledging, in writing, that the interim versions had not fully closed the gap.
What 26.0.5 actually closes
PaperCut's own vulnerability log and SonicWall's September 16 analysis agree that version 26.0.5 resolves CVE-2026-82077 and CVE-2026-82078 outright. The October 13 bulletin adds a third flaw to that release's patch list: CVE-2026-14780, described in the bulletin as a remote code execution vulnerability in PaperCut's scripting subsystem.
No source describes a bypass against 26.0.5 itself as of publication.
Patch validation and segmentation, not patch dates
The practical lesson from three failed remediation cycles on one authorization flaw is that a CVE number closing in the vendor's tracker is not evidence the attack surface closed with it. Teams that patched to 26.0.3 or 26.0.4 and marked PaperCut remediated were, per the vendor's own October 13 acknowledgment, still exposed to the chain watchTowr published.
- Confirm the running version is 26.0.5 or the equivalent 24.1.10/25.0.13 branch releases SonicWall names as fixed, not merely "patched since August."
- Treat PaperCut's web management interface as an administrative control plane, not an application endpoint, and remove it from direct internet reach — the exposure pattern Cybersecurity Dive flagged on August 31 specifically named internet-facing print servers in education and enterprise environments as the active targets.
- Segment print infrastructure from authentication and file-share tiers; CVE-2026-82078's path to arbitrary Java execution runs through the database connector, so a PaperCut server with broad network reach into other systems converts a single flaw into lateral movement.
- Watch for the CISA KEV entries added August 31, 2026, in any exposure-management tooling tied to patch SLAs, since the catalog addition predates two of the three subsequent bypass rounds.
PaperCut's pattern is not unique to print management, but it is a clean illustration of what a reactive, request-pattern-specific patch strategy produces against a motivated researcher working the same interface. The authorization logic that failed three times sat in a framework, Apache Tapestry, bundled into the product rather than written by PaperCut itself — a detail that matters for any security team mapping which third-party components inside a vendor's stack carry their own patch cadence separate from the application's version number.
Sources
This article was reported from the following sources.
- Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) — watchTowr Labs, 2026-10-09
- PaperCut NG/MF Security Bulletin (September 2026) — PaperCut Software, 2026-10-13
- Security vulnerability log - PaperCut — PaperCut Software, 2026-09-24
- PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE — Huntress, 2026-08-27
- CVE-2026-81578 Detail - NVD — National Vulnerability Database (NIST), 2026-08-28
- PaperCut issues emergency patches as threat actors target chained vulnerabilities — Cybersecurity Dive, 2026-08-31
- PaperCut NG/MF Unauthenticated RCE Chain - CVE-2026-82078 - SonicWall — SonicWall Capture Labs, 2026-09-16
- Behind the scenes - What happened after 9:42 a.m. on the 27th August 2026 — PaperCut Software, 2026-09-01
- CVE-2026-82077: PaperCut NG/MF Path Traversal Vulnerability — SentinelOne, 2026-09-24
