CVE-2026-81578 & CVE-2026-82078: PaperCut NG/MF Added to CISA KEV — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Command Shell or Scripting Engine
id: 8f3a2c91-4d7e-4b5a-9c21-7e6f0a1b2d3e
status: experimental
description: Detects the PaperCut NG/MF application server process spawning command shells, scripting engines, or reconnaissance binaries, consistent with post-exploitation activity following CVE-2026-81578 or CVE-2026-82078 exploitation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/31
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
  filter_java_path:
    ParentImage|contains:
      - '\JetBrains\'
      - '\IntelliJ'
      - '\Android Studio'
  condition: selection_parent and selection_child and not filter_java_path
falsepositives:
  - PaperCut scripting hooks configured by administrators to invoke print scripts — validate parent path is the PaperCut installation directory
  - Java-based applications other than PaperCut; scope parent path to PaperCut install directory in production tuning
level: high
---
title: PaperCut Web Interface Probed for Unauthenticated Administrative Endpoints
id: 2b7e4d15-9a3c-4f68-b1d4-5c8e2a7f9031
status: experimental
description: Detects HTTP requests to PaperCut NG/MF administrative or application endpoints from sources outside expected management networks, consistent with reconnaissance and exploitation attempts against CVE-2026-81578 missing authentication.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/31
tags:
  - attack.initial_access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/app'
      - '/admin'
      - '/api/'
  selection_status:
    sc-status:
      - 200
      - 302
  filter_rfc1918:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_uri and selection_status and not filter_rfc1918
falsepositives:
  - Legitimate remote administration over VPN with public-facing source NAT
  - Authenticated user portal access if PaperCut user web tools are intentionally internet-exposed (they should not be)
level: medium
---
title: Outbound Network Connection from PaperCut Server Process to Rare External Host
id: 4c9d6e27-1b8a-4f35-a2c9-9d3e5f7a1b06
status: experimental
description: Detects outbound connections initiated by the PaperCut application server process, which should have a narrow, well-defined set of external destinations. Unexpected egress is a strong indicator of payload staging or C2 following CVE-2026-81578/CVE-2026-82078 exploitation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/31
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\pc-app.exe'
    DestinationIp|rfc1918: 'false'
  filter_expected:
    DestinationHostname|contains:
      - 'papercut.com'
      - 'windowsupdate.com'
      - 'digicert.com'
  condition: selection and not filter_expected
falsepositives:
  - License server check-ins, update checks, and payment gateway / external database integrations — baseline and allowlist per environment
level: high

// Hunt 1: PaperCut process spawning suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "java.exe", "javaw.exe")
| where InitiatingProcessFolderPath has_any ("PaperCut", "papercut")
   or InitiatingProcessFileName =~ "pc-app.exe"
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt 2: Outbound connections from PaperCut servers to non-RFC1918 destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "java.exe", "javaw.exe")
| where InitiatingProcessFolderPath has "PaperCut" or InitiatingProcessFileName =~ "pc-app.exe"
| where not(ipv4_is_private(RemoteIP))
| where RemotePort in (80, 443, 8080, 8443)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), RemoteIPs = make_set(RemoteIP, 20), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessFileName
| order by ConnectionCount asc;

-- Identify PaperCut application server processes and their children/network activity
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)papercut|pc-app\.exe'
   OR (Name =~ '(?i)java' AND CommandLine =~ '(?i)papercut')

-- Enumerate listening PaperCut web ports and associated outbound connections
SELECT Pid, Name, Status, LocalAddr AS Local, RemoteAddr AS Remote
FROM netstat()
WHERE Local =~ ':(9191|9192)$'
   OR (Name =~ '(?i)pc-app|java' AND Status =~ 'ESTAB' AND NOT Remote =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)')

# PaperCut NG/MF KEV Response — Exposure & Hardening Verification
# CVE-2026-81578 / CVE-2026-82078 | Run elevated on the PaperCut Application Server

# 1. Identify installed PaperCut version
$paths = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
           "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*")
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'PaperCut' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation | Format-List

# 2. Confirm PaperCut Application Server service status
Get-Service -Name "PCAppSvc" -ErrorAction SilentlyContinue |
    Select-Object Name, Status, StartType

# 3. Check whether web ports 9191/9192 are listening and what scope is exposed
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192 } |
    Select-Object LocalAddress, LocalPort, OwningProcess |
    ForEach-Object {
        $_ | Add-Member -NotePropertyName Process -NotePropertyValue (Get-Process -Id $_.OwningProcess).ProcessName -PassThru
    } | Format-Table -AutoSize

# 4. COMPENSATING CONTROL: Restrict admin interface to a management subnet only
# Adjust -RemoteAddress to your approved admin/management CIDR before applying.
$mgmtCIDR = "10.10.5.0/24"   # <-- CHANGE THIS
if (-not (Get-NetFirewallRule -DisplayName "PaperCut Admin Restrict 9191" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName "PaperCut Admin Restrict 9191" -Direction Inbound -Protocol TCP -LocalPort 9191 -RemoteAddress $mgmtCIDR -Action Allow
    New-NetFirewallRule -DisplayName "PaperCut Admin Restrict 9192" -Direction Inbound -Protocol TCP -LocalPort 9192 -RemoteAddress $mgmtCIDR -Action Allow
    New-NetFirewallRule -DisplayName "PaperCut Admin Block 9191 Other" -Direction Inbound -Protocol TCP -LocalPort 9191 -Action Block
    New-NetFirewallRule -DisplayName "PaperCut Admin Block 9192 Other" -Direction Inbound -Protocol TCP -LocalPort 9192 -Action Block
    Write-Host "[+] Firewall restrictions applied for PaperCut admin ports." -ForegroundColor Green
}

# 5. Quick tripwire: any shells spawned under the PaperCut install directory recently?
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'pc-app\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|mshta\.exe' } |
    Select-Object TimeCreated, Message -First 20 | Format-List

# Linux PaperCut server verification
# 1. Installed version and service state
cat /opt/papercut/server/VERSION 2>/dev/null; systemctl status pc-app-server --no-pager

# 2. Confirm listening scope of 9191/9192 (0.0.0.0 = exposed to all interfaces)
ss -tlnp | grep -E ':(9191|9192)'

# 3. Check for shells spawned by the PaperCut service user or java process (auditd)
ausearch -ts recent -k exec 2>/dev/null | grep -E 'papercut|java' | grep -E 'cmd|sh|bash|curl|wget'

# 4. Recent outbound connections from the PaperCut process
ss -tnp | grep -E 'pc-app|java' | grep -v -E '10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.'