PaperCut RCE via CVE-2026-82078 Spawning cmd/powershell

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•8

Detects instances where the PaperCut application server process (pc-app.exe) or its underlying Java processes (javaw.exe or java.exe) spawn command-line interpreters such as cmd.exe or powershell.exe. This behavior is indicative of potential post-exploitation activity, specifically Remote Code Execution (RCE) via vulnerabilities targeting PaperCut servers.