PaperCut spent late August and early September shipping emergency fixes for a print server flaw that attackers were already using. According to new research from watchTowr, those fixes kept failing: the firm's researchers rebuilt a working, unauthenticated takeover chain against PaperCut's patched builds three separate times before the vendor closed the last hole on 10 September.
The write-up, by watchTowr's Piotr Bazydlo, is published on the watchTowr Labs blog. It matters because PaperCut NG and PaperCut MF run inside schools, universities, hospitals, government offices and law firms, and because an administrator who stopped after the first emergency build is still exposed to a full pre-authentication remote code execution chain. In plain terms, an attacker who can reach the server needs no password to run commands on it.
Four bypasses in two weeks
The saga began on 27 August, when PaperCut warned that an unknown flaw in version 26.0.3 was being exploited and published log-based indicators and temporary mitigations, but no patch. IntelFusions covered that advisory at the time. The exploited chain was later assigned two identifiers: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a post-authentication code execution bug. CISA added both to its Known Exploited Vulnerabilities catalog on 31 August.
watchTowr says it reproduced the code execution bug from PaperCut's indicators before any patch existed, then compared the first fix, version 26.0.4, against the vulnerable code to recover the full in-the-wild chain. From there, according to the firm's timeline:
- In 26.0.4, it found bypasses for both original fixes (tracked as WT-2026-0141 and WT-2026-0142), restoring a pre-auth chain. PaperCut fixed them in 26.0.4-PO build 76508.
- In build 76508, it bypassed the authentication fix again (WT-2026-0143) and found an entirely new code execution flaw, WT-2026-0144, now CVE-2026-82077.
- PaperCut fixed WT-2026-0143 in 26.0.4-PO build 76530 on 1 September, and CVE-2026-82077 in 26.0.5 on 10 September.
CVE-2026-82077 is the only one of the bypasses with its own CVE; watchTowr says PaperCut folded the others into the existing identifiers. The post publishes no severity scores, and it does not say any of the bypasses were exploited in the wild. Only the original two flaws are described that way.
A twenty-year-old framework with a blind spot
The root problem, watchTowr argues, is how PaperCut checks permissions inside Apache Tapestry 3, a web framework the researchers say has been obsolete for roughly 20 years. A single request can name a page anyone may visit and then chain on a form that belongs to an admin-only page. PaperCut checked authorization only on the first page in that chain.
PaperCut's fixes blocked specific routes rather than adding one global check. The latest bypass routed through the Home page into the product's first-run Setup Wizard, which the earlier patches had missed. Four requests walked through the wizard as if the server were brand new and reset the administrator's password. The new code execution bug then abused the Scan to Fax feature: watchTowr reports that an unvalidated connector name allowed a relative path traversal, letting an attacker point the fax command at an executable of their choosing on the host.
Upgrade to 26.0.5, then check for exposure
Only 26.0.5, or a later release, contains the fixes for every flaw in watchTowr's timeline. Builds 26.0.4 and 26.0.4-PO 76508 each remain open to a complete unauthenticated chain. watchTowr has released a detection artifact generator that, in the firm's words, determines exposure to the authentication bypass without running the full chain. Beyond patching, it is worth reviewing admin accounts for unexpected password changes and looking for requests to the setup pages on servers that finished their setup long ago.
GreyNoise has already tied the original chain to hundreds of compromised organizations. The lesson of watchTowr's timeline is that an emergency patch is a first draft, and a print server that received one in late August may still be one request away from a stranger's control.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.