PaperCut NG/MF RCE (CVE-2026-81578)

Overview

This workflow finds PaperCut NG and PaperCut MF Application Servers and sorts each one by whether its build predates Emergency Patch Release 2. That floor is the vendor fix for the CVE-2026-81578 / CVE-2026-82078 chain. 81578 is the unauthenticated config write on the web management interface (CVSS 8.8). 82078 is the step that turns a config write into code execution as the PaperCut service (CVSS 9.4). The run is one build compare, not two proofs. Both IDs landed on CISA KEV on 31 August 2026, due 14 September 2026. Give it hostnames, IP addresses, or CIDR ranges. The workflow TCP-probes 9191, 9192, and 9195, fingerprints each console with httpx, reads the product and build from the unauthenticated login (/, /user, /app), including the CSS cache-buster when that is the only number on the page, and classifies against the CNA patched-from line and the Tenable build table. It returns a per-host verdict you can feed into exposure management. A below-fix build is patch-lag. Hosts already flagged then get a read-only GET of SetupCompleted and ConfigEditor. A 200 that is not a login page is confirmed. The run does not log in, does not write configuration, and does not exercise 82078.

PaperCut has confirmed customer incidents. The first emergency patch shipped on 28 August 2026 and was bypassed the same day. Release 2 is the floor. v23 and earlier have no in-place fix. Mobility Print is a different service and is out of scope. Site Servers need the same patch. Card-ID lookup does not have to be on already: attackers turn it on after the bypass.

How the check reads a build

PaperCut's Application Server speaks HTTP on 9191 and HTTPS on 9192 by default (9195 is an extra HTTPS listener, not the login). The unauthenticated login names the product (NG or MF) in the title, meta content="PaperCut", or footer. A full PaperCut NG 25.0.11.75758 string is uncommon on current logins. The reliable unauthenticated number is the stylesheet cache-buster (/css/style.css?75758papercut-mf). version.txt is on disk, not an HTTP path. /api/health needs a key. Detect does not fetch SetupCompleted. Confirm does a GET only on already-flagged hosts.

PaperCut's CNA record lists both CVEs as affected before 24.1.10, 25.0.13, and 26.0.5. Tenable plugins 341347 (NG) and 341348 (MF) treat 24.1.9.76516 / 25.0.12.76510 / 26.0.4.76508 (MF one build lower) as "upgrade to". Those Tenable numbers sit on the same marketing line as the first emergency patch. Huntress published first-emergency Windows builds NG 25.0.12.76497 and MF 25.0.12.76496. A lab box labelled 26.0.4-P0-4560 (Build 76508) uses the same build Tenable calls fixed. The check therefore never emits patched for 26.0.4 / 25.0.12 / 24.1.9. A -P0- suffix or a Huntress first-emergency build is vulnerable_first_patch. A build below the Tenable table is vulnerable. Meeting the Tenable number without a P0 tag is under_investigation: confirm Release 2 on About. v23 and earlier are affected_no_inplace_fix.

Pipeline

1. Normalize the input scope (hostnames, IP addresses, CIDR ranges, or URLs) into a bare host list.
2. TCP-probe 9191, 9192, and 9195 on each host. 9191 and 9192 always go on to the version check; 9195 only if it answers.
3. Turn each host:port into a URL (HTTP on 9191, HTTPS on 9192 and 9195).
4. Fingerprint each URL with httpx for title and status.
5. Request /, /user, and /app, parse the PaperCut edition, CSS build, and any marketing string, and classify against the CNA line and the Tenable table.
6. Confirm only those flagged hosts with a read-only GET of SetupCompleted and ConfigEditor. No config write.
7. Emit one JSONL record per service and a summary line with verdict and confirmed counts.

Inputs

• Target scope. Hostnames, IP addresses, or CIDR ranges, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at Application Servers you are authorised to test. The probe hits 9191, 9192, and 9195. Reverse-proxied consoles on 80/443 are not in that list.

Outputs

• results.jsonl. One operator row per service: URL, edition, build, first_patch_p0, title, verdict, and action (install_release_2, upgrade_to_v24_plus_release_2, confirm_release_2_not_p0, read_build_on_host, leave).
• owner.csv. The same rows for a ticket queue.
• summary.json. Manager counts (product, affected, first_patch_p0, under_investigation) plus KEV dates (added 31 August 2026, due 14 September 2026) and both floor tables.

Sample output

The records below are illustrative and do not come from a real run. They show a host still on the first emergency patch, a host below the first-emergency marketing line, and a host on the disputed Tenable number. cve and cve_rce name the chain the build is scored against, not two detections.

{"cve": "CVE-2026-81578", "cve_rce": "CVE-2026-82078", "hosts_checked": 3, "product": 3, "affected": 2, "first_patch_p0": 1, "patched": 0, "under_investigation": 1}

FAQ

Which PaperCut NG/MF builds does this flag?

Anything below the CNA patched-from line 24.1.10 / 25.0.13 / 26.0.5. v23 and earlier have no in-place fix. On the 24.1.9 / 25.0.12 / 26.0.4 line the check flags Huntress first-emergency builds (NG 25.0.12.76497, MF 25.0.12.76496) and any -P0- suffix as vulnerable_first_patch, flags a build below the Tenable table as vulnerable, and leaves a Tenable-matching build as under_investigation. Site Servers and secondary print servers need the same patch. Mobility Print ports 9163/9164 are not this door.

Does the first emergency patch count as fixed?

No. Huntress and watchTowr showed bypasses of the 28 August 2026 emergency patch the same day. PaperCut says install Release 2 even if that first patch is already on. Do not treat Tenable's 26.0.4.76508 as patched: that number appears on a first-patch lab banner, and CNA still lists 26.0.4 as affected.

What does under_investigation mean on a PaperCut login?

The host looked like the Application Server (title PaperCut Login, content="PaperCut", or a CSS cache-buster) but the page did not give a version the check can call patched. A marketing-only 26.0.4 and a Tenable-matching build without a P0 tag are the same verdict. Read About on the host. The workflow will not invent a patched verdict.

Does unused card-ID lookup mean CVE-2026-81578 does not apply?

No. 81578 is the unauthenticated config write. Card-ID lookup does not have to be enabled already. Attackers turn the legitimate lookup keys on after the bypass and then trigger a card or user search. Release 2 turns that lookup off by default as hardening. SAML is not required either.

Does a flagged host mean both CVEs were proven?

No. A vulnerable row is patch-lag on the Emergency Patch Release 2 floor. Confirm only GETs SetupCompleted and ConfigEditor without credentials. It does not send the 81578 config-write request and it does not exercise 82078. Both IDs are on the row because PaperCut and CISA treat them as one chain.

Related workflows

• cPanel & WHM File Write (CVE-2026-65643). Same port-then-build pattern for a different vendor, instead of this PaperCut Release 2 compare.
• Full Network Port and Service Assessment. Map 9191/9192/9195 (and whatever sits in front of them) across a fleet first, instead of assuming every print host still uses the default ports.
• Full Subdomain Enumeration. Build the candidate list, including print. and papercut. names, before the version check.