Executive Summary
As of late August 2026, threat actors (including Silk Typhoon) are actively exploiting a critical pre-authentication remote code execution (RCE) chain in PaperCut NG and PaperCut MF print management software. The vulnerability stems from two flaws: CVE-2026-81578, which allows unauthenticated modification of system configurations via the web management interface, and CVE-2026-82078, which facilitates arbitrary Java bytecode execution through unsafe dynamic class loading.
Technical analysis shows attackers utilizing specially crafted requests to bypass authorization checks, eventually dropping malicious Java .class files into the application server's library directories. Observed post-exploitation activity focuses on system profiling and discovery, using commands like 'whoami & ver' to identify user accounts and operating system versions. Significant risk remains for organizations running legacy versions (v23 or older), which currently lack emergency patches.
Immediate action is required to apply emergency patches for major versions 24, 25, and 26. Organizations should also restrict public-facing management interfaces to trusted networks and monitor for high-confidence indicators such as irregular Derby database logs and unexpected file creations in the server/lib directory.