BREAKING: PaperCut NG/MF unauth admin config plus class-loading

PaperCut's 27 August 2026 bulletin is not a CVE-assignment of an old patch. The vendor is investigating confirmed customer incidents against PaperCut NG and PaperCut MF, including a university DFIR case that let them reproduce the bug. Two CVEs went public on 28 August 2026: CVE-2026-81578 (unauthenticated web requests can fire admin functions before access checks finish) and CVE-2026-82078 (the database connector will instantiate whatever JDBC driver class name is in config). The CVSS vectors tell the chain: 81578 is PR:N, 82078 is PR:H. The thing operators keep missing is the build they actually need to install.

Who is not in scope

All of this is from the PaperCut bulletin, not guesses.

• Print Deploy and Mobility Print. PaperCut says those components are not affected and do not need this patch.
• A server already on Emergency Patch Release 2. The patched installers are 24.1.9-PO-4560-02, 25.0.12-PO-4560-02, and 26.0.4-PO-4560 (MF and NG each have their own files). A plain 24.1.9 / 25.0.12 / 26.0.4 without PO-4560 is the unpatched point release.
• The bulletin names PaperCut NG and PaperCut MF only. It does not list Print Deploy, Mobility Print, or other SKUs as in-scope.

Internet-facing Application Servers are the ones PaperCut told to restrict first. Site Servers and secondary/print servers still need the same patched build. v23 and earlier are in scope, but there is no emergency patch for those trains: the bulletin's path is upgrade to the latest version.

What this is not

CVE-2026-81578 is not remote code execution by itself. The vendor impact is unauthenticated modification of certain system configurations. CVE-2026-82078 is not unauthenticated: CVSS v4.0 9.4 with PR:H, so it needs a way to change config first. This is not a print-spooler bug. It is not an official 24.1.10 / 25.0.13 / 26.0.5 GA cut. The Guard evidence pack currently lists those as fixedVersions; the downloadable emergency build on the bulletin is PO-4560 on 24.1.9 / 25.0.12 / 26.0.4. Waiting for 24.1.10 to appear in About is how you miss Release 2. This is not a CISA KEV listing as of this writing. PaperCut also says it is not an official release: they skipped the usual process for public-facing servers that cannot take other mitigations.

What broke

CVE-2026-81578: the web management interface can run administrative backend actions on unauthenticated remote requests under specific conditions, before access validation completes. Vendor CWE is CWE-306 (missing authentication for a critical function). CVSS v4.0 8.8 HIGH: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Impact in the bulletin: modify certain system configurations.

CVE-2026-82078: database connection utilities instantiate driver classes from configurable driver names with no allowlist. Vendor CWE is CWE-470 (unsafe reflection). CVSS v4.0 9.4 CRITICAL: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. If config is attacker-shaped, that loads arbitrary Java bytecode already on the PaperCut classpath as the server process (Windows IoC name: pc-app.exe).

Status line on the bulletin as of 28 August 2026, 10:08pm AEST: Emergency Patch Release 2 is published. Release 1 went to v25 and v26 at 02:10am AEST on 28 August. Release 2 added hardening with Huntress and watchTowr and is required even if you already applied Release 1. v24 got Release 2 later the same day (10:08pm AEST). The first emergency patch for v25/v26 is not the one to stay on.

Operator check

In the PaperCut NG/MF admin UI, open About and read the version string. You want PO-4560 in that string:

• v24: 24.1.9-PO-4560-02
• v25: 25.0.12-PO-4560-02
• v26: 26.0.4-PO-4560

If About shows 24.1.9, 25.0.12, or 26.0.4 with no PO-4560 suffix, you are on the stock point release, not the emergency patch. If About shows 24.1.10 / 25.0.13 / 26.0.5, that is a later train than the emergency files on the bulletin today; do not invent that those builds exist until PaperCut publishes them. Also grep server.log for the two strings PaperCut published as possible compromise markers:

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Missing, truncated, or deleted server.log files, and endpoint alerts around pc-app.exe, are the other bulletin IoCs. PaperCut says the absence of those lines is not proof you were not hit.

How to fix

Install Emergency Patch Release 2 from the 27 August 2026 bulletin (updated 28 August 2026). Use the MF or NG installer that matches your product and train, then follow PaperCut's standard upgrade procedure.

• MF v26: pcmf-setup-26.0.4-PO-4560.76507
• MF v25: pcmf-setup-25.0.12-PO-4560-02.76509
• MF v24: pcmf-setup-24.1.9-PO-4560-02.76515
• NG v26: pcng-setup-26.0.4-PO-4560.76508
• NG v25: pcng-setup-25.0.12-PO-4560-02.76510
• NG v24: pcng-setup-24.1.9-PO-4560-02.76516

SHA256 checksums are on the bulletin next to each file. Take the bits from papercut.com, not a mirror. Patch Site Servers and secondary/print servers too, not only the primary Application Server. If the Application Server is on the public internet, restrict web access to trusted IPs now, even before the upgrade finishes.

After install: if you use an external database for Card/ID number lookups (PaperCut calls this rarely used), add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server. Default is off (N). Without that key, NG/MF silently ignores external user lookup calls even when the Admin UI still shows the feature as configured.

This article is the operator write-up. The HOL Guard evidence page is the source record for CVE-2026-81578.

References

• PaperCut URGENT Security Advisory (27 Aug 2026, updated 28 Aug 2026)
• PaperCut NG/MF upgrade procedure
• HOL Guard CVE-2026-81578
• HOL Guard CVE-2026-82078
• CVE-2026-81578
• CVE-2026-82078