PaperCut’s second emergency patch left takeover paths open in the wild.
Unauthenticated HTTP access can cross administrative configuration into JDBC-backed operating-system execution.
Affects
PaperCut NG and PaperCut MF print-management application servers on Windows, Linux and macOS.
What it enables
Unauthenticated configuration takeover followed by code execution in the PaperCut server process despite installation of an earlier emergency patch
Attacker sends a direct-component request that displays a public page while invoking an administrative ConfigEditor or UserList component.→↓The authorization check validates the displayed page rather than the invoked component, allowing unauthenticated configuration changes.→↓Attacker configures external user lookup with a malicious JDBC driver, URL and SQL statement.→↓A forged user lookup activates Derby or H2 class-loading behavior and launches an operating-system process.→↓On Windows, observed and demonstrated execution reaches LocalSystem; on Linux, the public Metasploit test runs as the papercut service account.→↓PaperCut now says Emergency Patch Release 3 closes additional attack vectors observed in the wild and must replace Release 2.→↓PaperCut has not mapped the attack vectors surviving Release 2 to the known request path, the additional authentication bypass, or another primitive.
Research leadDiff Release 2 against Release 3, or obtain PaperCut’s mapping of each added control to the bypassed request path and affected build.
Why this matters
Release 2 was not merely superseded: PaperCut says Release 3 closes additional attack vectors observed in the wild and instructs Release 2 users to replace it.
Detail, proof-of-concept code and 4 sources
Required access
Unauthenticated HTTP reachability to the PaperCut NG/MF Application Server
Affected versions
All PaperCut NG and MF versions were treated as potentially impacted, Emergency Patch Release 1 was publicly bypassed, Emergency Patch Release 2 is not considered fully protective by PaperCut and Rapid7, Release 3 mitigation builds: MF v26 build 76531, MF v25 build 76532, MF v24 build 76534, NG v26 build 76530, NG v25 build 76533, NG v24 build 76535, Versions 23 and earlier must upgrade to a supported branch, All PaperCut NG and MF versions were treated as potentially affected; Huntress observed exploitation on 24.1.5.71847 and 25.0.10.75465 and reproduced it on NG 25.0.11.75758., Emergency Patch Release 3 provides mitigating builds for major versions 24, 25 and 26; older branches may require isolation or upgrade.
A direct-component request can show a public page while invoking an administrative ConfigEditor or UserList component. Because authorization follows the displayed page, an unauthenticated requester can alter external-user configuration and steer JDBC class loading or SQL execution into an operating-system process.
The public Metasploit test reached LocalSystem on Windows and the PaperCut service account on Linux. Release 2 users are not fully protected; Release 3 is the replacement.
Evidence
PaperCut states Release 3 closes additional attack vectors observed in the wild and instructs Release 2 users to replace it.Rapid7 documents the original patch bypass, says Release 2 users are not fully protected, and publishes the request and JDBC execution chain.Rapid7's public Metasploit pull request demonstrates SYSTEM execution on Windows, papercut-user execution on Linux, and explicitly verifies Release 2 against its known Release-1 bypass.
Preconditions
access:network:internet
reachable from the public internet
interaction:none
no user action required
Patch reality
Reaches end-of-life hardware
No
Assessment current to the cited sources as read on 2026-09-02; Release 3 had not yet completed PaperCut's normal QA and release process.
The same brief, every morning. One email a day, nothing else.
Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.