PaperCut NG/MF Unauthenticated RCE: Chained Flaws Allow Arbitrary Java Code Execution — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Shell or Utility Process
id: 8f2c4a91-6d3b-4e17-b8a2-5c9d1e4f7a30
status: experimental
description: Detects the PaperCut NG/MF Application Server process spawning command shells or download/cradle utilities, consistent with post-exploitation following unauthenticated remote code execution.
references:
  - https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\papercut.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare - custom PaperCut print scripting or third-party integrations invoking system commands; validate any hits against your deployment's configured scripts
level: high
---
title: Unauthorized Modification of PaperCut Server Configuration Files
id: 3b7e1d52-9a4f-4c28-a6b1-2e8f5d3c9a46
status: experimental
description: Detects write access to PaperCut server configuration files by processes other than the PaperCut Application Server or legitimate administrative tools, consistent with the trusted-configuration takeover stage of the exploit chain.
references:
  - https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\PaperCut NG\server\data\server.properties'
      - '\PaperCut MF\server\data\server.properties'
      - '\PaperCut NG\server\custom\'
      - '\PaperCut MF\server\custom\'
      - '\PaperCut NG\server\bin\'
      - '\PaperCut MF\server\bin\'
  filter_legit:
    Image|endswith:
      - '\pc-app.exe'
      - '\notepad.exe'
      - '\explorer.exe'
  condition: selection and not 1 of filter_legit
falsepositives:
  - Administrators editing server.properties via other editors; tune the filter to your environment's known admin tooling
level: high
---
title: Suspicious Inbound Connection Followed by Outbound from PaperCut Server Process
id: 61d9c3f4-2b8a-4e95-9d17-7a4c6b2f8e13
status: experimental
description: Detects the PaperCut Application Server process making outbound network connections to non-standard destinations, consistent with command-and-control or payload retrieval after remote code execution.
references:
  - https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\pc-app.exe'
      - '\papercut.exe'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '127.'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate PaperCut cloud licensing, update checks, or PaperCut Pocket/Hive integration traffic; baseline your server's known-good external destinations (PaperCut update/licensing endpoints) and allowlist them
level: medium

// Hunt: PaperCut Application Server spawning suspicious child processes (Windows endpoints via Defender / Sentinel)
// Tune the ParentProcessFileName set if your PaperCut deployment uses custom service wrappers.
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "papercut.exe")
   or InitiatingProcessCommandLine has_any ("papercut")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "curl.exe", "bitsadmin.exe", "certutil.exe", "rundll32.exe", "wmic.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteSessionIPAddress
| sort by TimeGenerated desc

// Hunt: Network access to PaperCut admin/application ports from unexpected sources (Syslog/CEF or firewall ingestion)
// Establishes which hosts touched 9191/9192 during the exposure window - feed results into your retro-hunt.
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationPort in (9191, 9192)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort
| order by ConnectionCount desc

-- Hunt for suspicious child processes of the PaperCut Application Server
-- and recent modifications to PaperCut configuration/script directories.
-- Deploy as a Velociraptor hunt across servers hosting PaperCut NG/MF.

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)cmd\.exe|powershell|pwsh|mshta|curl|certutil|bitsadmin|/bin/sh|/bin/bash|wget'
  AND Ppid IN (
        SELECT Pid FROM pslist()
        WHERE Exe =~ '(?i)pc-app\.exe|papercut'
           OR CommandLine =~ '(?i)papercut'
      )

-- Audit PaperCut configuration and custom script directories for recent unauthorized changes.
-- Compare timestamps and hashes against your pre-patch baseline; new .jar, .jsp, or modified
-- .properties files during the exposure window warrant immediate IR escalation.

SELECT FullPath, Size, Mtime, Btime,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=[
       'C:/Program Files/PaperCut*/server/data/server.properties',
       'C:/Program Files/PaperCut*/server/custom/**/*',
       'C:/Program Files/PaperCut*/server/bin-ext/**/*',
       '/opt/papercut/server/data/server.properties',
       '/opt/papercut/server/custom/**/*',
       '/opt/papercut/server/bin-ext/**/*'
     ])
ORDER BY Mtime DESC

# PaperCut NG/MF emergency patch verification and hardening check (Windows Application Server)
# Run elevated on each PaperCut Application Server.

# 1. Identify installed PaperCut version from the server install directory
$pcPaths = @("C:\Program Files\PaperCut NG", "C:\Program Files\PaperCut MF")
foreach ($p in $pcPaths) {
    if (Test-Path $p) {
        Write-Host "[+] Found PaperCut installation at $p"
        $verFile = Join-Path $p "server\data\version.txt"
        if (Test-Path $verFile) { Get-Content $verFile }
        # Cross-check the service binary version
        Get-ChildItem -Path (Join-Path $p "server\bin\win") -Filter "pc-app.exe" -ErrorAction SilentlyContinue |
            ForEach-Object { $_.VersionInfo | Select-Object FileVersion, ProductVersion }
    }
}

# 2. Verify against the version listed in the official PaperCut security bulletin for this emergency release
#    https://www.papercut.com/kb/Main/SecurityBulletins
#    If the installed version predates the patched release, download the emergency update and apply it now.

# 3. Check whether the server is internet-exposed (listening on 9191/9192 on a public interface)
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192 } |
    Select-Object LocalAddress, LocalPort, OwningProcess

# 4. Baseline audit: review server.properties for unexpected recent modification
$props = @("C:\Program Files\PaperCut NG\server\data\server.properties",
           "C:\Program Files\PaperCut MF\server\data\server.properties")
foreach ($f in $props) {
    if (Test-Path $f) {
        Get-Item $f | Select-Object FullName, LastWriteTime, CreationTime
        Get-FileHash $f -Algorithm SHA256
    }
}

# 5. Post-patch hardening: restrict admin interface to a management VLAN only, enable
#    MFA/SSO on admin login, and confirm the PaperCut service account is least-privilege
Get-Service | Where-Object { $_.DisplayName -match "PaperCut" } |
    Select-Object Name, DisplayName, Status, StartType

# PaperCut NG/MF emergency patch verification and retro-hunt (Linux Application Server)
# Run as root on each PaperCut Application Server.

# 1. Check installed version against the official security bulletin
#    https://www.papercut.com/kb/Main/SecurityBulletins
/opt/papercut/server/bin/linux-x64/app-server version 2>/dev/null || cat /opt/papercut/server/data/version.txt 2>/dev/null

# 2. Confirm what the server is listening on - is 9191/9192 reachable beyond the management network?
ss -tlnp | grep -E '9191|9192'

# 3. Hunt for suspicious child processes spawned by the PaperCut JVM (live check)
PC_PID=$(pgrep -f 'papercut' | head -1)
if [ -n "$PC_PID" ]; then
  ps --ppid "$PC_PID" -o pid,ppid,user,cmd
fi

# 4. Audit config and custom script directories for recent unauthorized modification
find /opt/papercut/server/data /opt/papercut/server/custom /opt/papercut/server/bin-ext \
  -type f -mtime -30 -exec ls -la {} \;
sha256sum /opt/papercut/server/data/server.properties

# 5. Review PaperCut access logs for unauthenticated requests hitting configuration/admin endpoints
#    during the exposure window - look for 200 responses on admin paths from external or workstation IPs
grep -Ei 'admin|config|SetupCompleted|template' /opt/papercut/server/logs/access-*.log | grep -E ' 200 ' | tail -100