PaperCut RCE via CVE-2026-82078: shell spawned from PaperCut process

Ibrahim Saud@tektrix

•updated Sep 17, 2026•13•0•9

This rule detects potentially malicious child processes (cmd.exe or powershell.exe) spawned by PaperCut application processes (pc-app.exe, PCClient.exe, or java.exe), which may indicate exploitation attempts such as RCE following an authentication bypass.