PaperCut Pre‑Auth RCE Chain Uncovered, Patch Bypass Threats Exposed
What did researchers discover about PaperCut's pre‑auth RCE chain?
Researchers at watchTowr Labs have revealed a pre‑authentication remote code execution chain in PaperCut MF/NG that can be combined with four newly disclosed patch‑bypass techniques, allowing attackers to execute arbitrary code on vulnerable print‑management servers without valid credentials across enterprise networks.
The chain stitches together several low‑severity flaws—two CVE‑2026‑82077 and CVE‑2026‑82078 input‑validation errors, plus CVE‑2026‑81578 a memory‑corruption bug—into a full‑blown remote code execution path. Each flaw alone would not grant code execution, but together they form a “paper‑cut” style attack surface that is surprisingly easy to weaponize.
How do the patch‑bypass techniques circumvent existing fixes?
After the initial disclosure, PaperCut released patches addressing the three CVEs. However, watchTowr identified four additional work‑arounds (WT‑2026‑0141 through WT‑2026‑0144) that effectively bypass those patches. The techniques exploit leftover debug endpoints, mis‑configured firewall rules, and an undocumented legacy API that the vendor did not disable after remediation.
Each bypass re‑opens a narrow window for the attacker to replay the pre‑auth payload. For example, WT‑2026‑0142 leverages an unauthenticated health‑check endpoint that still accepts raw commands, while WT‑2026‑0144 manipulates a legacy LDAP bind that the patch ignored.
Who is most likely to be impacted by this vulnerability chain?
Any organization that runs PaperCut MF or NG on Windows or Linux servers is in scope, especially those that expose the management console to internal networks without strict segmentation. Educational institutions, government agencies, and large enterprises that rely on centralized print management are typical victims because they often have legacy configurations and a high number of printers.
Because the exploit works before authentication, even tightly controlled user accounts provide no protection. The risk escalates when the print server holds elevated privileges on the domain, which is common in on‑prem deployments.
What immediate actions should defenders take?
1. Verify patch level. Confirm that the latest PaperCut security update—addressing CVE‑2026‑82077, CVE‑2026‑82078, and CVE‑2026‑81578—is installed on every server.
2. Disable legacy interfaces. Turn off the health‑check, debug, and legacy LDAP endpoints referenced in the WT‑2026‑0141‑0144 bypasses. This can often be done via the admin console or by editing the server’s configuration files.
3. Network‑segment the print management tier. Place PaperCut servers on a dedicated VLAN with strict inbound ACLs, allowing only trusted admin workstations to communicate.
4. Enable strict logging. Activate detailed request logging for the web service and monitor for unusual GET/POST patterns to the now‑disabled endpoints.
5. Conduct a rapid internal scan. Use GetKhojo’s attack‑surface scanner to enumerate exposed PaperCut instances and flag any that still expose the vulnerable endpoints.
How can organizations improve long‑term privacy hygiene around print services?
Beyond patching, adopting a “zero‑trust” mindset for print infrastructure reduces the attack surface. Regularly audit configuration drift, enforce least‑privilege service accounts, and rotate credentials for any service that integrates with Active Directory.
Integrating GetKhojo’s continuous monitoring platform provides visibility into newly exposed services and automatically correlates findings with known CVEs, helping teams stay ahead of emerging chains like this one.
What does this mean for you?
The PaperCut pre‑auth RCE chain demonstrates that even well‑maintained products can harbor multi‑step attack paths that bypass conventional patches. If your organization relies on centralized print management, treat this as a high‑priority remediation case: patch, disable legacy interfaces, segment the network, and employ continuous scanning to catch any lingering exposure.
Frequently asked questions
Can I still be compromised if I have applied the latest PaperCut patches?
Yes, if the legacy endpoints used by the WT‑2026‑0141‑0144 bypasses remain enabled, attackers can still chain the vulnerabilities together and achieve code execution.
How can I detect attempts to exploit the pre‑auth RCE chain?
Enable detailed web‑service logging on the PaperCut server and look for unusual requests to health‑check, debug, or LDAP bind URLs that were not part of normal operations.
Is there a mitigation if I cannot immediately apply the vendor patch?
Temporarily block external access to the PaperCut management console, disable the identified legacy APIs, and restrict traffic to the server to a trusted admin subnet until the patch can be deployed.
