PaperCut NG/MF auth bypass and RCE chain exploited at scale, but the 1.2M exposure count misleads

Flaw chain driven by an automated agent

In September 2026, a pair of flaws in PaperCut NG and PaperCut MF was exploited in the wild, with reports describing automated attacks carried out at scale rather than hand-crafted intrusions. That account comes from a dev.to analysis published on 19 September 2026, which also examines the exposure figures circulating alongside the story and finds they do not mean what they appear to mean.

PaperCut NG and MF are print management platforms used by schools, hospitals and enterprises, generally as internal services. The chain joins two vulnerabilities: CVE-2026-81578, an authentication bypass rated 9.8 on CVSS, and CVE-2026-82078, a flaw in dynamic class loading rated 9.1. Exploited together, they take an attacker from a skipped login to remote code execution on the server.

According to the dev.to post, proof-of-concept code for the pair is public and a Metasploit module has been proposed, with Rapid7 named in the post's references. What stands out about the September activity is the pace: an automated agent reportedly operated the chain at scale, showing how little time now passes between published exploit code and mass operational use.

Why 1.2 million matches is not a vulnerability census

ZoomEye queries run at collection time returned 1,249,245 results for app="PaperCut" and 1,285,744 for http.body="PaperCut". The dev.to author argues these are not counts of vulnerable print servers, for two reasons.

First, an http.body search is a text match over page content. Any page that mentions PaperCut, links to its documentation or embeds one of its widgets will match even when no PaperCut server is present. Second, the app fingerprint is broader than the product itself and can catch deployments and related components that share the fingerprint string.

The narrower queries returned nothing at all. app="PaperCut NG" came back with zero results, which reflects a coverage gap — the specific product name is not indexed as its own fingerprint — rather than an absence of PaperCut NG servers. vul.cve="CVE-2026-81578" also returned zero, which the author attributes to the incomplete CVE indexing that typically follows a recent disclosure.

What the large numbers do capture is how widely the PaperCut name appears across internet-facing infrastructure: a deployment footprint, not a risk assessment. Patched builds still match the broad fingerprint, and so do pages that merely mention the product. All figures are snapshots tied to their collection date.

How organisations should scope and respond

Because print management is normally an internal service, the analysis treats external search engines as a weak scoping signal and points to internal work instead:

• Build the server list from internal inventory rather than internet scans.
• Compare installed versions against the fixed releases for CVE-2026-81578 and CVE-2026-82078.
• Cut off public access, since a print server almost never needs to be reachable from the internet.
• If the server was exposed to an untrusted network, assume compromise and look for unexpected files or processes.
• Rotate the credentials the server holds for directory or database connections.

Why it matters

Two things make this incident worth attention beyond PaperCut deployments. The first is the target: print management servers sit on internal networks, hold directory and database credentials, and are easily forgotten in patch cycles — yet an authentication bypass chained with a class loading flaw turns them into remote code execution endpoints, with public proof-of-concept code and a proposed Metasploit module lowering the bar further. The second is tempo: an automated agent exploiting the chain at scale compresses the window between disclosure and mass compromise.

The measurement angle carries its own lesson. A fingerprint count is only as meaningful as the query behind it, and an implausibly large number should prompt a check of what the query actually matches rather than a headline. Here the honest summary is that the broad footprint is large, the specific product fingerprint is not indexed, and the CVE index is empty. Reliable scoping has to come from internal inventory, patching against the fixed releases, and network restrictions on servers that never needed internet exposure in the first place.