Emergency PaperCut Advisory: Active Zero-Day Campaign Targets Print Servers

Tue, 08 Sep 2026 14:20:29 +0000

If you have a PaperCut application server sitting on the public internet, stop what you are doing and restrict network access immediately. PaperCut Software has issued an urgent advisory warning of active, in-the-wild exploitation targeting both PaperCut NG and PaperCut MF, accompanied by out-of-band emergency security patches.papercut

Active Exploitation and Flaws

Security teams at PaperCut, Huntress, and watchTowr confirmed that attackers are actively chaining two newly disclosed vulnerabilities to compromise print servers. The attack vector allows an unauthenticated adversary to bypass access controls and achieve remote code execution under the context of the PaperCut server process.

CVE	Severity	Vulnerability Type	Impact
CVE-2026-81578	CVSS 8.8 (High)	Authentication Bypass (CWE-306)	Permits unauthenticated remote attackers to invoke administrative routines and alter system configurations
CVE-2026-82078	CVSS 9.4 (Critical)	Unsafe Class Loading (CWE-470)	Allows execution of arbitrary Java bytecode via dynamic database connector instantiation

When chained together, an unauthenticated attacker can manipulate database driver configurations remotely, instantiate malicious Java classes residing on the application classpath, and execute arbitrary operating system commands.papercut

What Attackers Are Doing

Telemetry and forensic data from affected environments reveal a consistent post-compromise routine once attackers pop the pc-app.exe server process.papercut

The PaperCut process spawns cmd.exe to run early reconnaissance commands such as whoami & ver, tasklist, and nltest /dclist:.papercut
Attackers pull secondary payloads to C:\ProgramData, including temporary execution binaries.papercut
Persistence is established via rogue remote access tools, specifically installing a Windows service called "Remote Access Service" (a SimpleHelp agent running SimpleService.exe) or staging AnyDesk.papercut
Log tampering is common, including deleted, missing, or unexpectedly truncated server.log files.papercut

Indicators of Compromise

Administrators should inspect their application servers for specific file and log artifacts.papercut

Look in server.log for strings matching jdbc:derby:memory:pwn;create=true, VALUES CAST(X'cafebabe', or DB Driver: <5-char random name>.papercut
Check for temporary files on disk matching \server\lib\<5-char-name>.class or scripts inside \server\data\content\.papercut
Audit Windows services for unexpected entries running SimpleService.exe under LocalSystem.papercut
Query EDR and SIEM tools for any child processes spawned directly by pc-app.exe or pc-app.papercut

Emergency Patching and Remediation

Because this is an active zero-day campaign, PaperCut bypassed its standard release cycle to publish hotfixes across versions 24, 25, and 26.

If you find you have any indication of compromise its recommended to isolate the server, wipe and rebuild.

Details: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory

If you manage any UniFi kit, it is time to schedule a maintenance window right away. Ubiquiti’s Security Advisory Bulletin 067 is a massive patch drop fixing 22 vulnerabilities across the stack, including three separate unauthenticated CVSS 10.0 flaws hitting UniFi Protect, UniFi OS, and UniFi Talk.

The Heavy Hitters

Having three simultaneous maximum-severity vulnerabilities in a single release is rare. None of them require existing credentials or user interaction, which makes them prime targets for anyone scanning your subnets.

The first big issue is CVE-2026-77537, a command injection bug in UniFi Protect that lets network attackers execute arbitrary commands directly on the host appliance. The second, CVE-2026-77550, is a CRLF injection flaw in UniFi OS that allows attackers to completely bypass authentication across Cloud Keys, Dream Machines, and UNVRs. The third, CVE-2026-77554, delivers another remote command injection vector inside the UniFi Talk VoIP suite.

The rest of the bulletin fixes 19 other issues ranging from CVSS 8.2 to 9.9. These cover privilege escalation, exposed debug endpoints, and secondary injection bugs across UniFi Network, Access, and Connect.

Component	Issue Type	Affected	Fixed In
UniFi OS Server	Auth bypass / Priv escalation	$\le$ 5.1.21	5.1.37+
UniFi OS Consoles (UDM, UNVR, Cloud Key)	Auth bypass / Priv escalation	$\le$ 5.1.26	5.1.31 / 5.1.32+
UniFi OS Express	Auth bypass	$\le$ 4.0.16	4.0.17+
UniFi Protect	Remote command injection	$\le$ 7.1.87	7.2.105+
UniFi Talk	Remote command injection	$\le$ 5.2.7	5.3.2+
UniFi Network	Priv escalation / Command injection	$\le$ 10.4.57	10.5.67+
UniFi Access	Priv escalation / Command injection	$\le$ 4.3.3	4.3.5+
UniFi Connect	Priv escalation	$\le$ 3.24.20	3.24.22+
UID Enterprise Agent	Command injection	$\le$ 1.61.8	1.62.1+
Protect AI Key	Priv escalation	$\le$ 2.1.3	2.2.6+

News: News