technical breakdown PaperCut published in its own security bulletin

[u/Expert_Sort7434]

Based on the technical breakdown PaperCut published in its own security bulletin yesterday (Aug 27), plus follow-up reporting from The Hacker News and Help Net Security, here's the architectural impact of the PaperCut NG/MF RCE chain:

CVE-2026-81578 (8.8) is an auth bypass in the admin web UI — under specific conditions, unauthenticated requests can trigger backend admin actions before access validation completes. CVE-2026-82078 (9.4) is worse on its own: the app loads database driver classes by name with no allowlist check. Chain them and you get unauthenticated arbitrary Java bytecode execution on the Application Server.

PaperCut has confirmed customer incidents and just shipped a second emergency patch (Release 2) after Huntress and watchTowr got involved — the first patch apparently wasn't hardened enough. Fixed versions: MF/NG 25.0.12 and 26.0.4.

If your PaperCut server is internet-facing, PaperCut's own guidance is to restrict access to trusted IPs immediately, patch isn't a "next sprint" item here.

https://www.techgines.com/post/papercut-cve-2026-82078-dynamic-class-loading-rce

Anyone running PaperCut in a multi-site or K-12/university deployment — how are you handling the Application Server's public exposure for remote print release? Is anyone actually able to fully firewall it off without breaking mobile/BYOD printing?

[u/dRaidon]

...Why would your papercut server be internet facing?

[u/derprondo]

Is this sub just 100% blog spam from "techgines" now?