Workflow
PaperCut NG/MF RCE (CVE-2026-81578)
PaperCut hosts in. One login-page build compare vs Release 2 for the CVE-2026-81578 chain (CVE-2026-82078, CISA KEV). Non-destructive.
Workflow
100%
loading
Loading content
loading
PaperCut hosts in. One login-page build compare vs Release 2 for the CVE-2026-81578 chain (CVE-2026-82078, CISA KEV). Non-destructive.
This workflow finds PaperCut NG and PaperCut MF Application Servers and sorts each one by whether its build predates Emergency Patch Release 2. That floor is the vendor fix for the CVE-2026-81578 / CVE-2026-82078 chain. 81578 is the unauthenticated config write on the web management interface (CVSS 8.8). 82078 is the step that turns a config write into code execution as the PaperCut service (CVSS 9.4). The run is one build compare, not two proofs. Both IDs landed on CISA KEV on 31 August 2026, due 14 September 2026. Give it hostnames, IP addresses, or CIDR ranges. The workflow TCP-probes 9191, 9192, and 9195, fingerprints each console with httpx, reads the product and build from the unauthenticated login (/, /user, /app), including the CSS cache-buster when that is the only number on the page, and classifies against the CNA patched-from line and the Tenable build table. It returns a per-host verdict you can feed into exposure management. A below-fix build is patch-lag. The run does not log in, does not write configuration, and does not exercise card-ID lookup.
PaperCut has confirmed customer incidents. The first emergency patch shipped on 28 August 2026 and was bypassed the same day. Release 2 is the floor. v23 and earlier have no in-place fix. Mobility Print is a different service and is out of scope. Site Servers need the same patch. Card-ID lookup does not have to be on already: attackers turn it on after the bypass.
PaperCut's Application Server speaks HTTP on 9191 and HTTPS on 9192 by default (9195 is an extra HTTPS listener, not the login). The unauthenticated login names the product (NG or MF) in the title, meta content="PaperCut", or footer. A full PaperCut NG 25.0.11.75758 string is uncommon on current logins. The reliable unauthenticated number is the stylesheet cache-buster (/css/style.css?75758papercut-mf). version.txt is on disk, not an HTTP path. /api/health needs a key. The check does not fetch the old SetupCompleted page.
PaperCut's CNA record lists both CVEs as affected before 24.1.10, 25.0.13, and 26.0.5. Tenable plugins 341347 (NG) and 341348 (MF) treat 24.1.9.76516 / 25.0.12.76510 / 26.0.4.76508 (MF one build lower) as "upgrade to". Those Tenable numbers sit on the same marketing line as the first emergency patch. Huntress published first-emergency Windows builds NG 25.0.12.76497 and MF 25.0.12.76496. A lab box labelled 26.0.4-P0-4560 (Build 76508) uses the same build Tenable calls fixed. The check therefore never emits patched for 26.0.4 / 25.0.12 / 24.1.9. A -P0- suffix or a Huntress first-emergency build is vulnerable_first_patch. A build below the Tenable table is vulnerable. Meeting the Tenable number without a P0 tag is under_investigation: confirm Release 2 on About. v23 and earlier are affected_no_inplace_fix.
host:port into a URL (HTTP on 9191, HTTPS on 9192 and 9195)./, /user, and /app, parse the PaperCut edition, CSS build, and any marketing string, and classify against the CNA line and the Tenable table.first_patch_p0, title, verdict, and action (install_release_2, upgrade_to_v24_plus_release_2, confirm_release_2_not_p0, read_build_on_host, leave).product, affected, first_patch_p0, under_investigation) plus KEV dates (added 31 August 2026, due 14 September 2026) and both floor tables.The records below are illustrative and do not come from a real run. They show a host still on the first emergency patch, a host below the first-emergency marketing line, and a host on the disputed Tenable number. cve and cve_rce name the chain the build is scored against, not two detections.
| url | host | port | cve | cve_rce | edition | product_version | build | first_patch_p0 | verdict | action | vulnerable | title | detail |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| http://print-a.example.com:9191 | print-a.example.com | 9191 | CVE-2026-81578 | CVE-2026-82078 | NG | 25.0.12.76497 | 76497 | true | vulnerable_first_patch | install_release_2 | true | PaperCut Login | PaperCut NG/MF 25.0.12.76497: first emergency patch (P0) is bypassed; install Emergency Patch Release 2 |
| https://print-b.example.org:9192 | print-b.example.org | 9192 | CVE-2026-81578 | CVE-2026-82078 | MF | 25.0.11.75758 | 75758 | false | vulnerable | install_release_2 | true | PaperCut Login | PaperCut NG/MF 25.0.11.75758 is below Emergency Patch Release 2 (CNA floor 25.0.13) |
| https://print-c.example.net:9192 | print-c.example.net | 9192 | CVE-2026-81578 | CVE-2026-82078 | NG | 26.0.4.76508 | 76508 | false | under_investigation | confirm_release_2_not_p0 | false | PaperCut Login | PaperCut NG/MF 26.0.4.76508 meets Tenable NG 26.0.4.76508 but CNA still lists this marketing version as affected, and the first emergency patch can share that build. Confirm Release 2 on the host, not P0 |
{"cve": "CVE-2026-81578", "cve_rce": "CVE-2026-82078", "hosts_checked": 3, "product": 3, "affected": 2, "first_patch_p0": 1, "patched": 0, "under_investigation": 1}Anything below the CNA patched-from line 24.1.10 / 25.0.13 / 26.0.5. v23 and earlier have no in-place fix. On the 24.1.9 / 25.0.12 / 26.0.4 line the check flags Huntress first-emergency builds (NG 25.0.12.76497, MF 25.0.12.76496) and any -P0- suffix as vulnerable_first_patch, flags a build below the Tenable table as vulnerable, and leaves a Tenable-matching build as under_investigation. Site Servers and secondary print servers need the same patch. Mobility Print ports 9163/9164 are not this door.
No. Huntress and watchTowr showed bypasses of the 28 August 2026 emergency patch the same day. PaperCut says install Release 2 even if that first patch is already on. Do not treat Tenable's 26.0.4.76508 as patched: that number appears on a first-patch lab banner, and CNA still lists 26.0.4 as affected.
The host looked like the Application Server (title PaperCut Login, content="PaperCut", or a CSS cache-buster) but the page did not give a version the check can call patched. A marketing-only 26.0.4 and a Tenable-matching build without a P0 tag are the same verdict. Read About on the host. The workflow will not invent a patched verdict.
No. 81578 is the unauthenticated config write. Card-ID lookup does not have to be enabled already. Attackers turn the legitimate lookup keys on after the bypass and then trigger a card or user search. Release 2 turns that lookup off by default as hardening. SAML is not required either.
No. The run is one login-page build compare against the shared Emergency Patch Release 2 floor. A vulnerable row is patch-lag on that floor. It does not send the 81578 config-write request and it does not exercise 82078. Both IDs are on the row because PaperCut and CISA treat them as one chain. As of 31 August 2026 there is no merged nuclei template for either ID. An open PR proposes an error-response check of an admin form, not a version compare.
print. and papercut. names, before the version check.Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.