PaperCut Authentication Bypass and Dynamic Class Loading: Pre-authentication RCE Chain Actively Exploited

1. Basic Information

• Article Title: PaperCut releases second emergency patch for exploited flaws
• Source: BleepingComputer
• Publication Date: 2026-08-28
• Original Source: BleepingComputer
• Related References: PaperCut urgent security advisory, Huntress, The Record, SecurityWeek
• Related Malware / Threat Groups / CVEs / Products: CVE-2026-81578, CVE-2026-82078, PaperCut MF, PaperCut NG
• Severity: Critical

2. Executive Summary

An authentication bypass in PaperCut MF/NG chains with insecure dynamic class loading, allowing unauthenticated remote attackers to execute Java code with server process privileges. Because bypass vectors remained in the initial fix, applying Release 2 is required.

3. Attack Flow

Attack Steps

1. An unauthenticated attacker connects to the management interface.
2. They use an authentication bypass to call backend management operations and modify database-related settings.
3. They specify an unwhitelisted driver class name to load a deployed Java class.
4. pc-app.exe executes commands with SYSTEM privileges.
5. They delete output files and server.log, then proceed with additional actions.

4. Attacker Position and Execution Location

• An attacker who reaches the target product and exploits vulnerable features or improper permission boundaries.
• After success, they operate with application or elevated privileges.

5. Visibility for Victims and Administrators

Victims

• Appears as normal operation or occurs without user interaction, making it difficult to detect through UI signs alone.

Administrator

• A process tree where pc-app.exe spawns whoami, ver, tasklist, and cmd.exe.
• Unknown .class, .cmd, and .out files under server/lib, and missing server.log.
• jdbc:derby:memory:pwn or "No suitable driver found" errors in derby.log.

6. Success and Failure Conditions

Success Conditions

• Reachable management interface.
• Unpatched against both the authentication bypass and dynamic class loading.
• The server loads the attacker's Java class.

Failure Conditions / Risk Mitigation

• Apply Release 2 and update versions prior to v23 to the latest release line.
• Restrict the management interface to trusted IPs or VPNs.
• Prevent the placement of unknown classes in server/lib and shell execution by pc-app.exe.

7. What Happens Upon Success

• Remote code execution equivalent to SYSTEM on the PaperCut server.
• Access to configuration and connection data, and deployment of additional payloads.
• Credential theft and a foothold for lateral movement.

8. Observable Logs

• Email: N/A.
• Proxy/SWG/DNS: Process tree showing pc-app.exe spawning whoami, ver, tasklist, and cmd.exe.
• Endpoint/EDR: Unknown .class, .cmd, and .out files under server/lib, and missing server.log.
• Identity/IdP: jdbc:derby:memory:pwn or "No suitable driver found" errors in derby.log.
• SaaS/Cloud: For cloud deployments, check WAF, load balancer, and audit logs.
• Network: Check for outbound connections to unknown destinations after successful exploitation.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Contact with the target is confirmed, but out-of-bounds operations or code execution are unconfirmed.
• User Interaction Confirmed: This issue requires no user interaction or is completed entirely via API operations.
• Initial Execution Confirmed: Unauthorized responses, processing, or suspicious child processes confirmed.
• Data Theft or Session Compromise Confirmed: Unauthorized information retrieval, credential access, or transmission confirmed.
• Post-Compromise Confirmed: Additional payloads, persistence, tampering, deletion, or lateral movement confirmed.

10. Investigation Playbook

• Trigger: Detection of vulnerability exploitation or abnormal behavior in PaperCut MF/NG.
• Initial Check: Verify version, exposure scope, patch status, initial anomaly timestamp, and source IP; preserve HTTP, application, and audit logs.
• Endpoint: Unknown .class, .cmd, and .out files under server/lib, and missing server.log.
• Authentication/Cloud: jdbc:derby:memory:pwn or "No suitable driver found" errors in derby.log.
• Subsequent Activity: Investigate additional files, outbound traffic, credential access, and impact on other assets.
• Containment: Apply Release 2 and update versions prior to v23 to the latest release line; restrict the management interface to trusted IPs or VPNs; block unknown classes in server/lib and shell execution by pc-app.exe; if compromise is confirmed, isolate the target and revoke related credentials and sessions.
• Determination Categories: Contact, preconditions met, initial success, information compromise, subsequent compromise.

11. Defense and Detection Ideas

• Single Event: Process tree showing pc-app.exe spawning whoami, ver, tasklist, and cmd.exe.
• Timeline Correlation: External request or operation -> vulnerable feature -> remote code execution equivalent to SYSTEM on the PaperCut server -> correlate subsequent behavior.
• Hunting: Process tree showing pc-app.exe spawning whoami, ver, tasklist, and cmd.exe; unknown .class, .cmd, and .out files under server/lib, and missing server.log; jdbc:derby:memory:pwn or "No suitable driver found" errors in derby.log.
• Log Gaps: Without correlating timestamps across HTTP, application, process, identity, and network logs, the success stage cannot be determined.
• Priority Countermeasures: Apply Release 2 and update versions prior to v23 to the latest release line; restrict the management interface to trusted IPs or VPNs; prevent the placement of unknown classes in server/lib and shell execution by pc-app.exe.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-81578 allows attackers to reach backend management operations and modify settings prior to authentication checks.
• CVE-2026-82078 fails to restrict database driver class names via a whitelist, allowing the execution of Java bytecode on the classpath.
• Huntress confirmed exploitation at two customer sites, observing SYSTEM-privilege command execution from pc-app.exe, deployment of Udydn.class / Moo97.class, and deletion of server.log.
• Multiple bypass vectors remained in the initial emergency fix, prompting PaperCut to release Release 2 for v24, v25, and v26.

Inference

• It is necessary to correlate requests, application processing, out-of-bounds operations, and subsequent behaviors rather than relying on individual IOCs alone.

Hypothesis

• The presence of actual exploitation or additional damage cannot be definitively determined from public information alone.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): An authentication bypass in PaperCut MF/NG chains with insecure dynamic class loading, allowing unauthenticated remote attackers to execute Java code with server process privileges.
• T1059.003 Command and Scripting Interpreter: Windows Command Shell (High): An authentication bypass in PaperCut MF/NG chains with insecure dynamic class loading, allowing unauthenticated remote attackers to execute Java code with server process privileges.
• T1070.004 Indicator Removal: File Deletion (High): An authentication bypass in PaperCut MF/NG chains with insecure dynamic class loading, allowing unauthenticated remote attackers to execute Java code with server process privileges.

14. Unknowns and Further Investigation

• Total number of compromised organizations, subsequent payloads, and data access scope.
• Whether all bypass vectors in Release 1 were leveraged in real-world attacks.

15. Impact on SOCs and Organizations

Organizations exposing management consoles to the internet require urgent response. Do not assume systems are safe just because Release 1 was applied; update to Release 2 and cross-check pc-app.exe, server/lib, derby.log, and server.log.

16. Role-Based Summary

• For SOCs: Review timelines for process trees where pc-app.exe spawns whoami, ver, tasklist, and cmd.exe; unknown .class, .cmd, and .out files under server/lib, and missing server.log; and jdbc:derby:memory:pwn or "No suitable driver found" errors in derby.log.
• For Administrators: Apply Release 2 and update versions prior to v23 to the latest release line; restrict the management interface to trusted IPs or VPNs; prevent unknown class placement in server/lib and shell execution by pc-app.exe.
• For Users: Report any unrecognized changes or service anomalies to the administrative department.