## https://sploitus.com/exploit?id=859BB400-2781-524F-B7D2-5BDBFD5082AE
# PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit
A **defensive** toolkit to check and understand exposure to the chained
**pre-auth remote code execution** vulnerabilities in PaperCut:
- **CVE-2026-81578** — Missing Authentication for Critical Function (CWE-306). A remote unauthenticated request can trigger an administrative backend action before access validation completes.
- **CVE-2026-82078** — Unsafe Dynamic Class Loading. A database connection utility can instantiate a driver class from a configurable name without an allowlist → arbitrary Java bytecode execution → host command execution (CVSS 9.4 Critical).
When chained: `Internet → no auth → config manipulation → unsafe class loading → arbitrary Java execution → host command execution`.
## What's inside
| File | Purpose |
|------|---------|
| `papercut-exposure-checker.py` | Scans a PaperCut server for exposure (non-destructive): version vs patch, web exposure, IOC |
| `papercut-cve-prevention.md` | Reference showing vulnerable vs safe code patterns for both CWE-306 and unsafe class loading |
## Usage
```bash
# Check web exposure of a PaperCut server (non-destructive)
python3 papercut-exposure-checker.py --url https://print.server:9191
# Evaluate a build version against patched builds
python3 papercut-exposure-checker.py --version 25.0.11.75758
# Scan a server log for published IOCs
python3 papercut-exposure-checker.py --log /usr/local/papercut/server/logs/server.log
# Full run + HTML/JSON reports
python3 papercut-exposure-checker.py \
--url https://print.server:9191 \
--version 25.0.11.75758 \
--log /usr/local/papercut/server/logs/server.log \
--html report.html --json report.json
```
## Important facts & mitigations
- **Patch Release 1 is NOT enough.** PaperCut published **Emergency Patch Release 2** on **28 Aug 2026** with additional hardening. Customers must install Release 2 even if they already installed the first emergency patch.
- **Release 2 available for:** PaperCut NG and MF v24, v25, v26 on Windows, Linux, macOS.
- **All versions affected:** the advisory applies to all PaperCut NG and MF versions; older installs outside patched branches should not be considered safe.
- **Active exploitation observed:** Huntress reported exploitation in two customer environments (primarily system discovery so far).
- **Immediate mitigation:** if the PaperCut Application Server is publicly reachable, restrict the web interface to trusted IPs/networks using a firewall or network ACL — even before patching.
### Published IOC to check
- Unusual `pc-app.exe` activity (post-exploitation)
- `server.log` missing, truncated, or deleted
- Abnormal DB errors: `No suitable driver found`, specific CardID lookup errors
**Note:** Absence of IOCs does NOT prove a server is clean.
## Important disclaimer
This toolkit is **defensive only**. It does not exploit anything and should
be used **only on servers you are authorized to test**. The prevention
reference shows **correct/secure code patterns** for learning and hardening —
never for attacking.
Before production use, **verify the exact Emergency Patch Release 2 build
numbers** from the vendor advisory and update `PATCHED_BUILDS` in the scanner
(placeholder values are used).