PaperCut CVE-2026-81578: hunt the emergency patch that did not stay a patch

You have seen this ticket. Print is still working. Someone applied the first emergency PaperCut patch when it dropped, the queue came back, and they closed it. The Application Server web UI is still on the internet because print admins do not like taking that box down twice in one week. That is the hunt. Not the CVE number. The hunt is the emergency patch that did not stay a patch.

CISA put CVE-2026-81578 and CVE-2026-82078 on KEV on 31 August 2026. If you only ran Patch 1, you are not done. Huntress and watchTowr got around that one. Release 2 is the real fix for v24, v25, and v26. v23 and older do not get a back-port. You upgrade. Site servers too. Pull the UI off the internet even after Release 2. Print still working is not a clean bill.

How PaperCut CVE-2026-81578 reaches the Application Server

PaperCut NG and PaperCut MF sit in a lot of shops as the thing that meters print. The Application Server has a web UI. In too many environments that UI is on the internet so a vendor, a branch, or a tired admin can reach it without VPN. That is the door. Nobody has to phish a printer. Nobody has to steal a cookie. They hit the login page the same way you do on Monday morning.

CVE-2026-81578 is the first half. An unauthenticated request can hit admin functions before auth finishes. That is not "they guessed a password." That is the UI doing admin work while it is still deciding whether you are allowed in. From there, they can change the config. You will not see a failed login storm. You may not see a login at all.

CVE-2026-82078 is the second half. The JDBC driver name is not allowlisted. Once they can write config, they can point that name at a Java class they want loaded. The PaperCut process, pc-app, loads it. On Windows, that process is SYSTEM. The chain is the RCE. I am not going to reconstruct it. You do not need the recipe to hunt the leftovers.

If you are the print admin who got that ticket, this is the part that feels unfair. The queue is fine. Users are printing. The box looks healthy. The emergency patch is sitting in the change log. That is exactly when this campaign wants you to stop looking.

Why Patch 1 did not stay a patch

PaperCut shipped an emergency patch under fire. That is not a knock. Then Huntress and watchTowr showed it did not hold. Release 2 went out for v24, v25, and v26. If you applied Patch 1 and closed the ticket, you applied a patch that did not stay a patch. That is the row I want in the queue this morning. Not "are we on PaperCut?" You already know that. "Did we stop at Patch 1?"

v23 and older do not get a back-port. Upgrade. Do not wait for a hot fix that is not coming. Site servers count. People forget those because they are not the Application Server everyone bookmarks. They still run this code.

Even after Release 2, pull the UI off the internet. A patched box with an admin interface hanging on 443 is still a print server you invited the world to poke. Restrict it to the jump box, the VPN, and the people who actually need it. That is not extra credit. That is how you stop the next chain from being another closed ticket.

Walk it like the tired ticket it is. You got a call that printing was weird, or a vendor bulletin, or a Rapid7 note that CISA had added the pair to KEV. You patched. You tested a print. You closed. Today you open that same change, and you ask one more question: was that Patch 1 or Release 2. If you cannot answer, treat it as Patch 1. If the UI is still public, treat it as exposed even if the build string looks current.

Do not wait for a ransomware family name. Huntress already saw this live. CISA already put it on KEV. The people who will get hurt next are the shops that patched once and went back to print.

Hunt for the emergency patch that did not stay a patch

Start with the process, not the CVE. pc-app should print. It should not spawn cmd, PowerShell, whoami, charmap, nltest, or quser. If it does, that is not a printer driver acting up. That is the Application Server acting like a foothold.

Then look at the disk. Unexpected .class files under server\lib, especially short junk names. Unexpected .cmd or .out under server\data\content. That is not a theme pack. That is not a queue job.

Then look at what else showed up. SimpleHelp is sitting there as "Remote Access Service." AnyDesk is under ProgramData you did not buy. Those are how a print server becomes a remote-access server while users keep printing.

Logs will lie to you if you only grep for success. Truncated server.log is a lead. So is weird JDBC noise. The hunts below use the strings PaperCut, which the researchers actually wrote down. I am not going to paste live malware URLs. You do not need them.

If print is up and Patch 1 is all you have, you are not hunting a maybe. You are hunting a box that looks recovered. Same shape as last week's NetScaler CVE-2026-8452 KEV ticket, different product. The service came back. The ticket got closed. The leftover is still on disk.

A clean bill is Release 2 on v24, v25, or v26, or an upgrade from v23, site servers included, UI off the internet, and those hunts are quiet. Anything short of that is still that closed ticket.

PaperCut CVE-2026-81578 hunts

Paste these. They are bound to the artifacts above. They do not reconstruct the exploit.

Hunt PaperCut CVE-2026-81578 in KQL

DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "pc-app.exe" or InitiatingProcessFileName =~ "pc-app"
| where FileName in~ ("cmd.exe","powershell.exe","powershell_ise.exe","whoami.exe","charmap.exe","nltest.exe","quser.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

DeviceFileEvents
| where Timestamp > ago(14d)
| where FolderPath has_any (@"\server\lib", @"\server\data\content")
| where FileName endswith ".class" or FileName endswith ".cmd" or FileName endswith ".out"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "pc-app.exe" or FileName in~ ("ace.exe","AnyDesk.exe","SimpleService.exe")
| project Timestamp, DeviceName, FileName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine

Hunt PaperCut CVE-2026-81578 in Falcon CQL

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(?i)(pc-app\.exe|pc-app)$/
| FileName=/^(?i)(cmd\.exe|powershell\.exe|whoami\.exe|charmap\.exe|nltest\.exe)$/

#event_simpleName=FileWritten
| FileName=/(?i)\.(class|cmd|out)$/
| FilePath=/(?i)\\server\\(lib|data\\content)\\/

Hunt PaperCut CVE-2026-81578 in Splunk

(index=windows OR index=sysmon OR sourcetype=*papercut* OR source="*server.log")
  (("pc-app" AND (cmd.exe OR powershell OR whoami OR charmap OR nltest))
   OR "jdbc:no:x"
   OR "VALUES CAST"
   OR "jdbc:derby:memory:pwn"
   OR cafebabe
   OR "Remote Access Service"
   OR SimpleService.exe)

Hunt PaperCut CVE-2026-81578 in Kibana

(process.parent.name:(pc-app.exe OR pc-app) AND process.name:(cmd.exe OR powershell.exe OR whoami.exe OR charmap.exe))
OR (file.path:*server\\lib* AND file.extension:class)
OR (message:("jdbc:no:x" OR "VALUES CAST" OR "derby:memory:pwn" OR cafebabe))

Sources

PaperCut, URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026), updated 31 August 2026.

Huntress, PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE.

BleepingComputer, PaperCut releases second emergency patch for exploited flaws, 28 August 2026.

Rapid7, PaperCut NG/MF Critical Zero-Day Exploited in the Wild, KEV noted 31 August 2026.

What This Means for Your Team

Print still working is not a close. If you applied Patch 1 and walked away, treat the Application Server as still in the incident until Release 2 is on, or you are off v23, and the hunts are quiet. Site servers count. The UI does not belong on the internet. Hunt the emergency patch that did not stay a patch.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We use the Defender, Sentinel, Conditional Access, and Azure licenses you already have. We hunt pc-app children that should not exist, odd files under server\lib, and the print ticket that got closed because the queue came back.

Assessing Your Security Posture with a free Inception Foresight M365 Assessment

Want to see where your environment stands? Grab our free Inception Foresight M365 Assessment. No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on X.