Key points
- WatchTowr Labs identified four vulnerabilities in PaperCut MF enabling remote code execution.
- The issues can be chained together to bypass authentication requirements entirely.
- PaperCut has assigned three CVE IDs to these findings, bundling flaws and bypasses.
WatchTowr Labs has published details on a critical security chain affecting PaperCut MF printing management software. The research reveals that attackers can execute arbitrary code on affected systems without needing valid user credentials. This pre-authentication remote code execution capability poses a significant risk to organisations relying on the platform for document handling and print services.
In plain English
Remote code execution allows an attacker to run malicious programs on a target computer. In this case, the vulnerability chain means no password or login is required to start the attack. WatchTowr Labs explains that the complexity arises because PaperCut grouped multiple distinct issues into fewer CVE identifiers. This bundling includes both the original flaws and methods to bypass subsequent patches, creating confusion for security teams trying to verify their protection status.
The background
The disclosure, titled "Death By A Thousand PaperCuts," details four specific vulnerabilities tracked by WatchTowr IDs WT-2026-0141 through WT-2026-0144. PaperCut has assigned CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578 to these issues. According to the research summary, the vendor combined vulnerabilities and their corresponding patch bypasses into single CVE records. This practice makes it difficult for administrators to distinguish between fixed flaws and those that remain exploitable through alternative methods.
What changes now
Organisations using PaperCut MF must carefully review their current version status against the disclosed WatchTowr IDs. The existence of patch bypasses suggests that simply applying the latest update may not fully mitigate the risk if the underlying chain is not addressed. Security teams should monitor for further clarifications from the vendor regarding which specific updates resolve all components of the execution chain. No confirmed complete fix has been detailed in the initial disclosure.
What to do and how to stay safe: PaperCut
- Audit your network to identify all devices running PaperCut MF and check their current version numbers.
- Review the specific WatchTowr IDs mentioned in the report to understand which flaws apply to your environment.
- Monitor vendor communications for updated patching guidance that addresses the reported bypass techniques.
- Restrict network access to PaperCut services to limit exposure from untrusted external sources.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the main risk of this vulnerability?
Attackers can execute code on PaperCut systems without authentication, potentially taking full control of the server.
How many CVE IDs are associated with this issue?
PaperCut has assigned three CVE IDs: CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.
Why are there more WatchTowr IDs than CVE IDs?
PaperCut bundled multiple vulnerabilities and patch bypasses into single CVE identifiers, according to WatchTowr Labs.
