CVE-2026-81578 & CVE-2026-82078: PaperCut NG/MF Zero-Day Actively Exploited — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Suspicious Child Processes
id: 9f2c7a41-6b3d-4e58-a1c9-papercut0001
status: experimental
description: Detects the PaperCut NG/MF application server process spawning command shells, script interpreters, or living-off-the-land binaries — consistent with post-exploitation of CVE-2026-81578 / CVE-2026-82078.
references:
  - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\java.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative scripting invoked via PaperCut's print scripting features — validate against approved admin activity
level: critical
---
title: PaperCut Server Linux Post-Exploitation Shell Execution
id: 3b8e1d52-7a4f-4c21-b9e6-papercut0002
status: experimental
description: Detects the PaperCut pc-app Java process on Linux spawning interactive shells, downloaders, or reconnaissance commands following exploitation of the CVE-2026-81578 authentication bypass chain.
references:
  - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'pc-app'
      - 'papercut'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate PaperCut custom print scripts invoking shell — uncommon; review and allowlist by exact command line
level: critical
---
title: Unauthenticated Requests to PaperCut Administrative Endpoints
id: 61c4f9a8-2d7b-4e33-a5f1-papercut0003
status: experimental
description: Detects inbound HTTP requests targeting PaperCut NG/MF administrative and application paths from external or non-management source addresses, consistent with probing or exploitation of CVE-2026-81578.
references:
  - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/app'
      - '/admin'
      - '/api'
      - '/rpc'
  selection_port:
    dst-port:
      - 9191
      - 9192
  condition: selection_uri and selection_port
falsepositives:
  - Legitimate user and admin traffic to PaperCut — baseline source addresses and alert on anomalies from outside known management/user subnets
level: high

// Hunt 1: PaperCut server process spawning suspicious child processes (post-exploitation behavior)
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe","certutil.exe","bitsadmin.exe","curl.exe","whoami.exe","net.exe","nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "pc-app.exe"
   or (InitiatingProcessFileName =~ "java.exe" and InitiatingProcessCommandLine has_any ("papercut","pc-app"))
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;
// Hunt 2: Inbound connections to PaperCut default ports from non-RFC1918 sources (exposure validation)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where LocalPort in (9191, 9192)
| where ActionType == "InboundConnectionAccepted"
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP matches regex @"^172\.(1[6-9]|2[0-9]|3[0-1])\.")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl
| order by FirstSeen asc;

// Hunt 3: Requests to PaperCut admin/application paths in Syslog/CEF-ingested web logs
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (9191, 9192)
| where RequestURL has_any ("/app", "/admin", "/api", "/rpc")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, RequestURL, RequestMethod, DeviceProduct
| order by FirstSeen asc;

-- Hunt: PaperCut application server post-exploitation artifacts
-- Identifies suspicious child processes of pc-app and unexpected network connections
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'pc-app|papercut'
   OR (Name =~ 'cmd|powershell|pwsh|mshta|rundll32|certutil|curl|wget|bash|sh$'
       AND Username =~ 'SYSTEM|root|papercut|pc-app')

-- Hunt: Network connections held by the PaperCut service process
SELECT Pid, Name, Pid as ProcessPid, Status, Family,
       LocalAddress.IP AS LocalIP, LocalAddress.Port AS LocalPort,
       RemoteAddress.IP AS RemoteIP, RemoteAddress.Port AS RemotePort
FROM netstat()
WHERE Name =~ 'pc-app|java'
  AND Status =~ 'ESTAB|LISTEN'
ORDER BY LocalPort

# PaperCut NG/MF CVE-2026-81578 / CVE-2026-82078 Response Script
# Run elevated on the PaperCut Application Server
# Step 1: Identify installed version
$pcPath = "C:\Program Files\PaperCut NG"
if (Test-Path $pcPath) {
    Get-Item "$pcPath\server\bin\pc-app.exe" -ErrorAction SilentlyContinue |
        Select-Object FullName, @{N='Version';E={$_.VersionInfo.ProductVersion}}
}
$pcMF = "C:\Program Files\PaperCut MF"
if (Test-Path $pcMF) {
    Get-Item "$pcMF\server\bin\pc-app.exe" -ErrorAction SilentlyContinue |
        Select-Object FullName, @{N='Version';E={$_.VersionInfo.ProductVersion}}
}

# Step 2: Preserve volatile evidence BEFORE patching (IR requirement)
$evidence = "C:\IR-Evidence-$(Get-Date -Format yyyyMMdd-HHmm)"
New-Item -ItemType Directory -Path $evidence -Force | Out-Null
Get-Process pc-app -ErrorAction SilentlyContinue | Export-Clixml "$evidence\pcapp-process.xml"
Get-NetTCPConnection -OwningProcess (Get-Process pc-app -ErrorAction SilentlyContinue).Id -ErrorAction SilentlyContinue |
    Export-Csv "$evidence\pcapp-connections.csv" -NoTypeInformation
Get-WinEvent -LogName Application -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'papercut'} | Export-Csv "$evidence\app-events.csv" -NoTypeInformation
# Preserve PaperCut server logs
Copy-Item "$pcPath\server\logs\*" "$evidence\server-logs\" -Recurse -Force -ErrorAction SilentlyContinue
Copy-Item "$pcPath\server\data\*" "$evidence\server-data\" -Recurse -Force -ErrorAction SilentlyContinue

# Step 3: Check for suspicious child processes of pc-app (active compromise indicator)
$pcPid = (Get-Process pc-app -ErrorAction SilentlyContinue).Id
if ($pcPid) {
    Get-CimInstance Win32_Process | Where-Object {$_.ParentProcessId -eq $pcPid} |
        Select-Object ProcessId, Name, CommandLine, CreationDate
}

# Step 4: Confirm listening exposure of the web interface
Get-NetTCPConnection -State Listen -LocalPort 9191,9192 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess

# Step 5: INTERIM HARDENING - restrict PaperCut admin interface to a management subnet until patched
# Adjust -RemoteAddress to your approved management network
New-NetFirewallRule -DisplayName "PaperCut Admin - Mgmt Only (CVE-2026-81578)" `
    -Direction Inbound -Protocol TCP -LocalPort 9192 `
    -RemoteAddress "10.10.5.0/24" -Action Allow -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "PaperCut Admin - Block All Else (CVE-2026-81578)" `
    -Direction Inbound -Protocol TCP -LocalPort 9192 -Action Block -ErrorAction SilentlyContinue

# Evidence preservation and exposure check BEFORE patching
mkdir -p /root/ir-evidence-$(date +%Y%m%d-%H%M)
cd /root/ir-evidence-*
ps auxf > process-tree.txt
ss -tlnp | grep -E '9191|9192' > listening-ports.txt
ls -la /proc/$(pgrep -f pc-app | head -1)/fd > open-files.txt 2>/dev/null

# Preserve PaperCut server and access logs (adjust install path as needed)
cp -r /opt/papercut/server/logs ./server-logs/ 2>/dev/null
cp -r /home/papercut/server/logs ./server-logs/ 2>/dev/null

# Look for suspicious children of the PaperCut java process
PCPID=$(pgrep -f 'pc-app' | head -1)
ps --ppid "$PCPID" -o pid,ppid,user,cmd

# Interim exposure control: restrict 9192 to management subnet via iptables
iptables -A INPUT -p tcp --dport 9192 -s 10.10.5.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9192 -j DROP