PaperCut's Missing Auth Check Just Became a KEV: What CVE-2026-81578 and CVE-2026-82078 Chain Into

Read the chain from the outside in and it collapses to a single sentence: a request that should have required a login did not. Everything downstream, the malicious database driver, the Java bytecode, the reverse shell running as SYSTEM, is only reachable because the front door answered a caller it had never authenticated.

What CISA added to KEV on August 31

On August 27, 2026, PaperCut published an urgent security advisory stating it was investigating active exploitation against PaperCut NG and PaperCut MF, with confirmed customer incidents. The next day it assigned two CVEs, and on August 31 CISA added both to the KEV catalog on the strength of that exploitation. The two entries are worth reading side by side, because the interesting part is how ordinary each half is on its own.

On its own, CVE-2026-82078 needs the ability to change configuration, which is normally an administrator's job. On its own, CVE-2026-81578 lets an anonymous caller change some settings, which sounds like a hardening item rather than an emergency. Put them in series and the missing auth check hands an anonymous caller the exact configuration surface the reflection bug needs.

The chain: an unauthenticated config write that becomes bytecode execution

The public technical writeups, including Rapid7's exploitation analysis and the Metasploit module, describe a clean four-step path. It is worth walking because every step after the first depends on the first.

PaperCut is built on the Apache Tapestry framework, whose "complex direct" request format can name one page to display and a different page whose component should execute. PaperCut validated access only against the page being displayed. By naming a public page such as Error or Exception for display while invoking an administrative component, an attacker slips past the check entirely. The request looks like this:

POST /app?service=direct/1/Error/ConfigEditor/quickFindForm
POST /app?service=direct/1/Error/ConfigEditor/$Form
POST /app?service=direct/1/Error/UserList/$QuickFind.$Form

The first two requests give an unauthenticated caller PaperCut's configuration editor. They are used to rewrite four settings that normally wire PaperCut to an external card database:

user-lookup.db-driver
user-lookup.db-url
user-lookup.id-to-username-sql
user-lookup.enabled

Pointed at a malicious JDBC URL and SQL statement, those settings turn a legitimate integration feature into a code-execution primitive. The final request submits a user search, which triggers the external lookup, which runs the attacker's SQL. Through PaperCut's bundled Apache Derby driver, that SQL opens an attacker-controlled H2 connection, which runs an inline init statement that plants a JavaScript-backed trigger, which the bundled Nashorn engine executes as an operating-system process. In Rapid7's demonstration the resulting session ran as SYSTEM.

That is a long fuse, and defenders sometimes read the length as reassurance. It should read the other way. Four of the five links are legitimate product features doing exactly what they are designed to do. Only the first link is a defect, and it is the cheap one: a check that should have run and did not.

Why this is a DAST finding, not just a patch window

The reflex response to a KEV entry is to look up your version and schedule a patch. That is necessary and it is not sufficient here, for three reasons that only a request to the running server can settle.

First, the version string can lie about the patch level. PaperCut shipped three emergency patches in a week, and the public Metasploit module explicitly bypasses the first two by naming the Home page for display instead of Error. A server that reports as patched may have applied a superseded patch. The question that matters is not "what build is this" but "does the unauthenticated config-editor request still succeed."

Second, exposure is a runtime property. PaperCut's own first instruction is not "patch," it is "restrict web access to trusted IP addresses," because a server no one can reach is not part of anyone's incident. Whether the interface is reachable from where an attacker stands is not in the version number. It is in whether a request from that position gets an answer.

Third, the class of bug is one dynamic testing is built to catch. Missing authentication for a critical function is not a version match, it is a behavior: a route that answers a request it should have refused. You confirm it the way an attacker finds it, by sending the unauthenticated request and reading the response. That is the same act whether the product is PaperCut, a third-party appliance, or an admin console your own team shipped last sprint.

This is the work NightVision is built for. It sends the request to the running application at its deployed address and returns the complete request and response for every finding, so "the config editor answered an unauthenticated caller" arrives as something you can replay, not a severity label to re-derive. Because it runs from CI on every build, the check becomes a standing part of the pipeline rather than a fire drill triggered by a KEV entry after the fact.

A Nuclei template for the missing-auth entry point

Detection should test the entry point, not the payload. Reproducing the full chain would require modifying a live server's configuration, which is neither safe nor necessary; the vulnerable condition is entirely visible at step one. The check below sends the unauthenticated configuration-editor request and decides based on whether the server serves the component or bounces the caller to a login. It never writes configuration.

id: papercut-ng-mf-cve-2026-81578-auth-bypass

info:
  name: PaperCut NG/MF Unauthenticated Config Editor (CVE-2026-81578)
  author: nightvision
  severity: critical
  description: |
    Detects the CVE-2026-81578 authentication bypass by requesting the
    Tapestry ConfigEditor component through a public display page. A
    vulnerable server serves the administrative component to an
    unauthenticated caller instead of redirecting to login. Non-destructive:
    reads only, never modifies configuration.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81578
    - https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
  classification:
    cwe-id: CWE-306
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
  tags: papercut,cve,cve2026,auth-bypass,kev

http:
  - method: POST
    path:
      - "{{BaseURL}}/app?service=direct/1/Error/ConfigEditor/quickFindForm"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "quickFindForm=quickFindForm"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "ConfigEditor"
          - "config.editor"
        condition: or
      - type: word
        part: body
        negative: true
        words:
          - "service=page/Login"
          - "id=\"login"
        condition: or

Two honest caveats. The positive matchers key on markers of the rendered configuration editor; the exact strings vary by PaperCut build and localization, so validate them against a known-vulnerable instance in a lab before trusting a clean result, and tune the word lists to your version. And a negative result is evidence, not proof: a server behind an IP allow-list will refuse the request from the scanner's position while remaining reachable from another. Test from the network position that matters.

Custom checks like this are first-class in a NightVision scan. You can upload a Nuclei template and assign it to a target so the PaperCut check runs alongside the standard authentication, injection, and SSRF coverage on every scheduled scan, rather than as a one-off script somebody has to remember to run.

What to check in your own admin and config endpoints

PaperCut is this week's example, but the shape is the recurring one, and it is worth turning on your own applications while the pattern is fresh. The bug was not the reflection or the JDBC trick. It was an administrative capability reachable without an administrator. Three questions find the same class of flaw before it has a CVE:

• Which routes change state without proving who is calling? Config editors, feature flags, integration settings, and webhook receivers are the usual suspects, because they are built for a trusted operator and then quietly exposed.
• Does the auth check guard the component, or only the page around it? PaperCut's flaw was precisely this gap: access was validated on the page displayed, not the component executed. Framework-level indirection makes the two easy to conflate.
• Would a scan even reach these routes? Admin and config endpoints are often absent from the spec and unreachable by a crawler that only follows visible links. Deriving the endpoint list from source is how they get onto the list that testing actually covers.

That last point is where NightVision spends its effort. It tests running web applications and APIs at their deployed address, fully authenticated, from CI, and returns the complete request and response for every finding so a result reproduces exactly instead of arriving as a severity label someone has to re-derive. For the applications your teams write, it derives the endpoint list from source rather than from a hand-maintained specification, so the administrative route that never made it into the docs still gets its authentication tested. The PaperCut chain is a reminder of why that route is the one that matters.

The exploit was five steps long. Only the first one was a bug, and it was the check that never ran.

Frequently asked questions

What are CVE-2026-81578 and CVE-2026-82078?

They are the two vulnerabilities in the PaperCut NG/MF exploit chain that PaperCut disclosed on August 27, 2026 and CISA added to its Known Exploited Vulnerabilities catalog on August 31, 2026. CVE-2026-81578 is a missing authentication for critical function bug (CWE-306) that lets an unauthenticated remote attacker reach administrative configuration functions. CVE-2026-82078 is an unsafe reflection bug (CWE-470) that turns an attacker-controlled configuration change into arbitrary Java bytecode execution. Neither works well without the other.

Which PaperCut versions are affected?

PaperCut treats all versions of PaperCut NG and PaperCut MF as potentially impacted. Emergency Patch Release 3 is the fix and supersedes the two earlier emergency patches, which a public Metasploit module was shown to bypass. Any server that applied only the first or second emergency patch is not fully protected.

How do I test whether my PaperCut server is exposed?

The entry point is an unauthenticated HTTP request. You send a request to the configuration-editor component and observe whether the server serves it or redirects you to a login. A patched server rejects the unauthenticated request; a vulnerable one processes it. The Nuclei template in this post performs that non-destructive check. The most reliable answer comes from testing the deployed instance at its address, from the network position that matters, not from checking a version string.

Is this a DAST finding or a patch-management finding?

Both, and they answer different questions. Version scanning tells you a build with a published advisory is installed. Dynamic testing tells you whether the vulnerable request actually succeeds against the running server, which depends on the patch level, the emergency-patch bypass, and whether the interface is reachable at all. The missing-authentication entry point is exactly the kind of unauthenticated-endpoint behavior a DAST scan exercises directly.

Why does an authentication bypass keep turning into remote code execution?

Because the dangerous capability behind the auth check is usually intentional. In PaperCut's case, configuring an external database driver is a legitimate administrator feature. The bypass does not create that power; it removes the check that was supposed to stand in front of it. This is the recurring shape of the CWE-306 pattern: a critical function that is fine for an administrator to call, reachable by someone who was never authenticated.