CVE-2026-73032: Unauthenticated RCE in PapersGPT for Zotero — Detection and Remediation Guide

---
title: Zotero Process Spawning Shell or Script Interpreter
description: Detects Zotero (potentially via PapersGPT CVE-2026-73032 exploitation) spawning command shells, script interpreters, or download utilities. Zotero should never launch these in normal operation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73032
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
status: experimental
id: 8f2c1a47-3b9e-4d51-a6c2-9e7d5f180234
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\zotero.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; Zotero plugin developers debugging locally
level: high
---
title: Zotero Process Outbound Connection to Non-Standard Endpoint
description: Detects Zotero making network connections to uncommon ports or raw IP destinations, consistent with CVE-2026-73032 post-exploitation C2 or a malicious custom LLM endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73032
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/12
status: experimental
id: 2b7d9f13-6a4c-4e08-b1d5-3c8a0f692417
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\zotero.exe'
  filter_sync:
    DestinationHostname|endswith:
      - '.zotero.org'
      - 'zotero.org'
  filter_llm_common:
    DestinationHostname|endswith:
      - 'openai.com'
      - 'anthropic.com'
      - 'googleapis.com'
  condition: selection and not 1 of filter_*
falsepositives:
  - Self-hosted or custom LLM endpoints legitimately configured in PapersGPT (baseline these explicitly)
  - Third-party Zotero sync servers (WebDAV)
level: medium
---
title: Zotero Writing to Persistence or Startup Locations
description: Detects the Zotero process writing executables or scripts to startup folders, temp directories with subsequent execution patterns, or other persistence-oriented locations, consistent with CVE-2026-73032 post-exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73032
  - https://attack.mitre.org/techniques/T1060/
author: Security Arsenal
date: 2026/05/12
status: experimental
id: 5e1a8c36-7f2b-49d4-9c31-b4e6d2a50871
tags:
  - attack.persistence
  - attack.t1060
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\zotero.exe'
  selection_target:
    TargetFilename|contains:
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\'
  condition: selection_image and selection_target
falsepositives:
  - None expected; Zotero installers run as setup binaries, not the main process
level: high

// Hunt 1: Zotero spawning suspicious child processes (post-exploitation of CVE-2026-73032)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "zotero.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","curl.exe","certutil.exe","bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: Zotero outbound connections to non-standard destinations (custom LLM endpoint / C2)
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "zotero.exe"
| where RemoteUrl !has_any ("zotero.org", "openai.com", "anthropic.com", "googleapis.com")
| summarize ConnectionCount = count(), Destinations = make_set(RemoteUrl), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessCommandLine
| order by ConnectionCount desc;

-- Hunt for Zotero processes with suspicious child processes (CVE-2026-73032 post-exploitation)
-- Flags zotero.exe parents of shells, script engines, or download utilities
LET parents = SELECT Pid, Name, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Name =~ '(?i)zotero'

SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.CommandLine AS ChildCommandLine,
       child.Ppid AS ParentPid,
       parent.Name AS ParentName,
       parent.Username AS Username,
       child.CreateTime AS ChildStartTime
FROM pslist() AS child
JOIN parents AS parent ON child.Ppid = parent.Pid
WHERE child.Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|curl|wget|bash|sh)'

# CVE-2026-73032 - PapersGPT for Zotero detection and verification script
# Run as administrator or deploy via RMM/Intune across endpoints

$zoteroPaths = @(
    "$env:ProgramFiles\Zotero",
    "${env:ProgramFiles(x86)}\Zotero",
    "$env:LOCALAPPDATA\Zotero"
)

$zoteroFound = $false
foreach ($path in $zoteroPaths) {
    if (Test-Path (Join-Path $path 'zotero.exe')) {
        $zoteroFound = $true
        Write-Output "[+] Zotero found at: $path"
    }
}
if (-not $zoteroFound) { Write-Output "[-] Zotero not installed in standard locations"; }

# Enumerate Zotero profiles and look for the PapersGPT extension
$profileRoot = "$env:APPDATA\Zotero\Zotero\Profiles"
if (Test-Path $profileRoot) {
    Get-ChildItem $profileRoot -Directory | ForEach-Object {
        $extDir = Join-Path $_.FullName 'extensions'
        if (Test-Path $extDir) {
            Get-ChildItem $extDir -ErrorAction SilentlyContinue | Where-Object {
                $_.Name -match '(?i)papersgpt'
            } | ForEach-Object {
                Write-Output "[!] VULNERABLE COMPONENT: PapersGPT extension found: $($_.FullName)"
                Write-Output "    ACTION REQUIRED: Update to patched version or remove immediately."
            }
        }
        # Also check extensions.json for install records
        $extJson = Join-Path $_.FullName 'extensions.json'
        if (Test-Path $extJson) {
            $content = Get-Content $extJson -Raw
            if ($content -match '(?i)papersgpt') {
                Write-Output "[!] PapersGPT referenced in extensions.json for profile $($_.Name)"
            }
        }
    }
}

# Flag suspicious recently-modified scripts/executables in Zotero profile dirs (dropped payloads)
if (Test-Path $profileRoot) {
    Get-ChildItem $profileRoot -Recurse -Include *.exe,*.bat,*.ps1,*.vbs,*.js -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        ForEach-Object { Write-Output "[!] Suspicious recent script/binary in profile: $($_.FullName) (modified $($_.LastWriteTime))" }
}

Write-Output "[*] Verification complete. Pair results with EDR process-tree telemetry for zotero.exe."

# CVE-2026-73032 - Locate PapersGPT extension on macOS/Linux Zotero profiles
for dir in "$HOME/Zotero" "$HOME/.zotero" "$HOME/Library/Application Support/Zotero"; do
  if [ -d "$dir" ]; then
    echo "[+] Zotero data dir: $dir"
    grep -ril "papersgpt" "$dir" --include="extensions.json" 2>/dev/null && \
      echo "[!] PapersGPT detected - update or remove immediately"
    find "$dir" -name "*papersgpt*" 2>/dev/null
  fi
done

# Flag recent child processes of zotero (requires auditd on Linux)
command -v ausearch >/dev/null && \
  ausearch -ts recent -k exec 2>/dev/null | grep -i zotero | head -20