🤝 Open to acquisition: what is built, what runs, and what a buyer inherits · 📉 Corrections record: AI mistakes, counted by class and fed back into the next run · 📢 New post: Patched on Day One, Unprotected Today: PaperCut's KEV Pair and the Third Emergency Patch · 📝 Also fresh: The Only Field That Moved: Citrix CVE-2026-8452 and the Five Siblings With No Clock · 🚦 Beacon — the FedRAMP 20x KSI emitter — see what it emits ✨ · 🆕 20x Hub: program reference, kept current · 🧪 Free tool: KSI Quick Check — paste, run, get the verdict
← Blog
FedRAMPConMonCISAVulnerability Management

Patched on Day One, Unprotected Today: PaperCut's KEV Pair and the Third Emergency Patch

On August 31 CISA added two entries to the Known Exploited Vulnerabilities catalog, and they are the same incident:

  • CVE-2026-81578 — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability, CWE-306.
  • CVE-2026-82078 — PaperCut NG/MF Unsafe Reflection Vulnerability, CWE-470.

Both carry a federal remediation due date of September 14, and each entry's description points at the other: this vulnerability can be chained with…. Known ransomware campaign use: unknown, on both.

Thirteen days is a comfortable clock by BOD 26-04 standards. That is not what makes this one worth an afternoon. What makes it worth an afternoon is that PaperCut has now published three emergency patches in five days, and Rapid7 updated its advisory today to say that anyone running the first or the second is not fully protected. The organisations most exposed right now are the ones that moved fastest.

The five days

Ordered, because the order is the story:

  • August 27 — PaperCut publishes an urgent advisory. Active exploitation and confirmed customer incidents, with no CVE and no vulnerability class yet attached to it. A university customer's security and DFIR team supplied the forensic material that let PaperCut reproduce the bug at all.
  • August 28, 02:10 AEST — emergency patches for versions 25 and 26, followed later the same day by version 24.
  • August 28 — the two CVEs are assigned and publish to NVD at 16:18 UTC. CISA records its SSVC assessment the same day. Rapid7 publishes its analysis, and updates it hours later to note that the first emergency patch can be bypassed.
  • August 28, 20:36 UTC — a Metasploit exploit module lands as a pull request, with a session transcript showing SYSTEM on Windows Server 2025.
  • August 31 — both CVEs go on the KEV catalog. Due September 14.
  • September 1 — a third emergency patch. Rapid7's remediation note: any organization that has applied either the original first version or the second version of the emergency patch is not fully protected.

The KEV clock started on day five, on a fix that changed on day six. A program whose trigger is the catalog row would have opened its ticket on August 31 and gone looking for a patch that was already superseded by the time anyone read the ticket.

What the chain actually does

PaperCut is built on Apache Tapestry, whose "complex direct" request format lets one request name the page to display and a different page holding the component to execute. PaperCut validated access to the page being displayed. So an attacker names the public Error page for display, and names an administrative component for execution:

/app?service=direct/1/Error/ConfigEditor/quickFindForm
/app?service=direct/1/Error/ConfigEditor/$Form
/app?service=direct/1/Error/UserList/$QuickFind.$Form

Exception works in place of Error. So, against the first emergency patch, did Home — which is how a fix shipped on August 28 was already public knowledge on August 28.

The first two requests hand over the configuration editor without credentials. That is all CVE-2026-81578 is: not a forged token, just a request whose two halves are checked against different pages. Four settings get rewritten:

user-lookup.db-driver
user-lookup.db-url
user-lookup.id-to-username-sql
user-lookup.enabled

Those exist so an administrator can point PaperCut at an external card or user database. Repointed, they become CVE-2026-82078. The bundled Apache Derby driver accepts a CALL statement activating its foreignViews feature, which opens an attacker-supplied H2 JDBC URL; H2 honours an inline INIT statement that creates a JavaScript-backed trigger; PaperCut ships the Nashorn engine, so that trigger starts an operating-system process. The third request — the user search — is what fires the lookup.

Nothing was uploaded. Derby, H2 and Nashorn are all product components, present because the product needs them. An endpoint-control story that rests on catching a dropped file has nothing to catch here. What the chain does need is outbound network access from the print server to the attacker's H2 instance, which makes egress from that host a live mitigation rather than a hygiene item — the same argument we made about agent infrastructure, applied to the least glamorous server in the building.

Neither row describes the pair

CISA scored both CVEs through SSVC on August 28. Read them side by side:

CVE-2026-81578 CVE-2026-82078
Exploitation active active
Automatable yes no
Technical impact partial total

Each of those is defensible on its own. The authentication bypass is trivially scriptable but only writes configuration — partial. The class-loading bug owns the host completely but requires the ability to change that configuration first, so as an isolated finding it is not automatable.

Chained, the property is automatable and total, and that combination appears in neither record. It cannot: SSVC decision points describe one vulnerability, and the thing being exploited in the wild is a composition of two. BOD 26-04's fastest tier is looking for exactly the combination that no row here reports.

The CVSS numbers land in a similar place, from a different direction. NVD's NIST primary score puts CVE-2026-81578 at 9.8 Critical and CVE-2026-82078 at 9.1 Critical. PaperCut's own CVSS v4.0 assessments put them at 8.8 High and 9.4 Critical. The two systems disagree about which half is worse, and both are describing halves. Since one update closes both, the ranking never mattered — but the framing does, because it is the 8.8 that gets you in the door and the 9.4 that is waiting on the other side.

The build number is not the remediation state

Here is where this gets uncomfortable for evidence.

PaperCut's CVE record lists affected versions as everything below 24.1.10, 25.0.13 and 26.0.5. NVD's CPE matching data — the structured ranges most scanners consume — stops one build short in every line: versionEndExcluding of 24.1.9, 25.0.12 and 26.0.4.

That gap is not theoretical. The build Rapid7's module demonstrates remote code execution against, in the transcript attached to the public pull request, is PaperCut MF 26.0.4 (Build 76494) — a version the CPE ranges do not mark as vulnerable.

And underneath both is the emergency-patch sequence, which the version string does not encode at all. These builds, as the vendor says plainly, have not been through the normal release process. Three of them shipped in five days. So "we are on the patched build" now needs to survive a follow-up question — which patch — that neither your scanner, nor the NVD record, nor Rapid7's own version-based check routine can answer for you.

The ownCloud listing last week left us with the question can you name the artifact that changed and the version it reached? This is the same question with the screws tightened: the artifact changed three times, kept the same name, and only the third one works.

What triage has to look for

CISA's required-action text on both entries names the Forensics Triage Requirements, as it does on every entry added since July. The KEV row also carries a structured forensicTriage field, and on these two it reads No — where 38 of the 57 entries added since July 1 read Yes, including entries added the same week. Whatever that flag selects for, it did not select the actively exploited chain that ends in SYSTEM.

The vendor's own artifacts are worth more attention than the flag, and they are unusually specific. In server.log:

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Both are failure messages — the residue of a lookup that did not work. A clean run may not leave them. The Metasploit module sets the four configuration keys, triggers the lookup, and then resets the configuration, which means the current state of that config is not evidence of anything; only a record of the change is. PaperCut also lists missing, truncated or deleted server.log files as an indicator, which is the tell that survives when the entries do not.

So the hunt is narrower than "look for the exploit." It is: was user-lookup.db-driver ever written, and by whom, and was anyone logged in when it happened? Configuration-change history and administrative authentication events, correlated, at second granularity. If that pairing is not retained back to at least August 27 — and realistically earlier, since the disclosure followed an incident rather than preceding one — the honest answer to the triage question is we cannot tell, and that is worth writing down as such.

The unglamorous part

PaperCut is a print-management platform. For most organisations it is corporate IT rather than a component inside a FedRAMP authorization boundary, and the boundary question here is genuinely short: it usually is not in one. What it is — every time — is a Java application server holding a configuration that points at your identity store, running with enough privilege to answer "who is this person and what are they allowed to print," on a host that nobody drew on the diagram.

That is the capability this keeps coming back to, and it has not changed since the light switch or the network fabric: an inventory that includes the print server, at its version, owned by someone named, with its patch level recorded as a fact about the asset rather than an inference from a build number. That is what the Novaprospect audit engine is built to keep — asset context that travels with the asset, and a remediation record that survives the fix being reissued twice.

The question this one leaves behind is not about PaperCut. For every emergency patch you applied in the last month, do you know whether the vendor has since replaced it? A version bump announces itself. A quietly reissued out-of-band build does not — and on a fourteen-day clock, the difference between the two is the difference between a closed finding and a finding you closed early.

Reference