CVE-2026-81578: PaperCut NG/MF Pre-Auth RCE Added to CISA KEV — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Shell or Script Interpreter
id: 3b7f2a91-6c4d-4e8a-b1f5-9d2c7e4a6f08
status: experimental
description: Detects the PaperCut Application Server process (pc-app.exe) spawning command shells, PowerShell, or script interpreters — consistent with post-exploitation of CVE-2026-81578 pre-auth RCE.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\pc-app.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate PaperCut hotfolder scripts or custom print scripting may invoke cmd.exe — tune per environment after baseline review
level: high
---
title: PaperCut Server Process Executing Reconnaissance Commands
id: 8e1c4d72-2a5b-49f7-c3d6-1b8e5a2f9c47
status: experimental
description: Detects reconnaissance and discovery commands executed under the PaperCut Application Server process, a common post-exploitation behavior following RCE via CVE-2026-81578.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1018/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1018
  - attack.t1069
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\pc-app.exe'
  selection_cmd:
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig'
      - 'net user'
      - 'net group'
      - 'net localgroup'
      - 'nltest'
      - 'quser'
      - 'systeminfo'
      - 'arp -a'
      - 'netstat'
      - 'tasklist'
  condition: selection_parent and selection_cmd
falsepositives:
  - Highly unlikely under the PaperCut server process; investigate any hit
level: critical
---
title: Linux PaperCut Server Spawning Shell
id: 5f9a3e18-7b2c-4d91-a6e4-8c1f3b7d2e59
status: experimental
description: Detects the PaperCut server process on Linux spawning interactive shells or download utilities, consistent with post-exploitation of CVE-2026-81578.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'pc-app'
      - 'papercut'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Custom PaperCut print scripting integrations may invoke shells — baseline and tune
level: high

// Hunt: PaperCut Application Server spawning suspicious child processes (CVE-2026-81578 post-exploitation)
// Works against Defender for Endpoint device data; for EDR-less servers, ingest Sysmon via AMA and swap to the Event table.
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","wscript.exe","cscript.exe","curl.exe","wget.exe","regsvr32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "pc-app.exe"
   or InitiatingProcessCommandLine has_any ("pc-app", "papercut")
| where FileName in~ (suspiciousChildren)
   or ProcessCommandLine has_any ("whoami","net user","nltest","certutil","bitsadmin","iex ","downloadstring","invoke-webrequest","enc ","-enc ","frombase64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP, ReportId
| sort by TimeGenerated desc

// Hunt: inbound connections to PaperCut web ports from unusual sources (reconnaissance/exploit delivery)
// Enrich with your asset inventory — flag sources that are not print clients or admin workstations.
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where LocalPort in (9191, 9192)
| where ActionType == "InboundConnectionAccepted"
| summarize ConnectionCount = count(), UniqueSources = dcount(RemoteIP), SourceIPs = make_set(RemoteIP, 25)
    by DeviceName, LocalPort, bin(TimeGenerated, 1h)
| where UniqueSources > 50 or ConnectionCount > 500   // spike in distinct sources = scanning/exploitation pattern
| sort by UniqueSources desc

-- Hunt: PaperCut server process lineage and network exposure
-- Deploy as a hunt across servers running PaperCut NG/MF Application Server.

-- Part 1: Live process tree — find pc-app and any child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field='Exe') AS Executable
FROM pslist()
WHERE Name =~ '(?i)pc-app|papercut'
   OR CommandLine =~ '(?i)pc-app'

-- Part 2: Suspicious children of PaperCut (correlate Ppid from Part 1, or filter directly)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)cmd|powershell|pwsh|mshta|rundll32|certutil|bitsadmin|wscript|cscript|bash|sh$|curl|wget'
  AND Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ '(?i)pc-app'
  )

-- Part 3: Network listeners on PaperCut ports — confirm exposure
SELECT Pid, Name, Path, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort IN (9191, 9192)

# CVE-2026-81578 PaperCut NG/MF exposure and compromise-indicator assessment
# Run elevated on each PaperCut Application Server.

Write-Host "=== PaperCut Installation Discovery ===" -ForegroundColor Cyan
$installPaths = @("C:\Program Files\PaperCut NG", "C:\Program Files\PaperCut MF")
foreach ($p in $installPaths) {
    if (Test-Path $p) {
        Write-Host "[+] Found installation: $p"
        $verFile = Get-ChildItem -Path $p -Recurse -Filter "version.txt" -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($verFile) { Get-Content $verFile.FullName }
        Get-ChildItem "$p\server\bin\pc-app.exe" -ErrorAction SilentlyContinue |
            Select-Object FullName, @{N='FileVersion';E={$_.VersionInfo.FileVersion}}
    }
}

Write-Host "`n=== Service State ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.DisplayName -match "PaperCut" } |
    Select-Object Name, DisplayName, Status, StartType

Write-Host "`n=== Network Exposure (9191/9192) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192 } |
    Select-Object LocalAddress, LocalPort, OwningProcess
# WARNING: 0.0.0.0 means reachable from any interface — restrict via host firewall.

Write-Host "`n=== Host Firewall Check ===" -ForegroundColor Cyan
$rules = Get-NetFirewallRule -Direction Inbound -Action Allow -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match "PaperCut|9191|9192" }
if (-not $rules) { Write-Host "[!] No explicit inbound firewall rules scoping PaperCut ports found." }

Write-Host "`n=== Suspicious Child Processes of pc-app.exe (last 24h) ===" -ForegroundColor Cyan
$pcApp = Get-CimInstance Win32_Process -Filter "Name='pc-app.exe'"
foreach $proc in $pcApp {
    Get-CimInstance Win32_Process -Filter "ParentProcessId=$($proc.ProcessId)" |
        Where-Object { $_.Name -match "cmd|powershell|pwsh|mshta|rundll32|certutil|bitsadmin|wscript|cscript|curl|wget" } |
        Select-Object CreationDate, ProcessId, Name, CommandLine
}

Write-Host "`n=== Outbound Connections from PaperCut Server ===" -ForegroundColor Cyan
if ($pcApp) {
    foreach ($proc in $pcApp) {
        Get-NetTCPConnection -OwningProcess $proc.ProcessId -State Established -ErrorAction SilentlyContinue |
            Where-Object { $_.RemotePort -notin 9191,9192 -and $_.RemoteAddress -notmatch "^(127\.|::1)" } |
            Select-Object RemoteAddress, RemotePort, State
    }
}
Write-Host "`nAssessment complete. Escalate any suspicious child processes or unknown outbound connections to IR immediately." -ForegroundColor Yellow