Update, 27 August 2026: The flaw now has identifiers and a mechanism, and it is a chain of two. CVE-2026-81578 (8.8) is an access-control failure in the web management interface: a crafted request names one page to be rendered and another that owns the component, and the authorisation check trusts the rendered page while missing the permission requirement for the actual component. That bypass lets an attacker edit a configuration file, which reaches CVE-2026-82078 (9.4) — unsafe dynamic class loading that instantiates database drivers from configurable driver names without checking them against an allowlist. watchTowr's Jake Knott describes the chain directly: CVE-2026-81578 allows you to bypass authentication, and from there you can edit a configuration file to exploit CVE-2026-82078 and gain remote code execution.

That explains the odd indicator below. The error about no suitable driver being found for a jdbc URL is not an unrelated fault — it is what a manipulated driver name leaves behind. Patches exist for v24, v25 and v26. Attacks have been observed on two customer environments, running Base64-encoded reconnaissance and deploying OS-agnostic Java class files, then deleting server.log, derby.log and a file named Udydn.out — which is the article's point about missing logs, with filenames attached. Reported by Huntress (John Hammond, Andrew Brandt), watchTowr and Rapid7. Hammond's caution stands: there is not enough evidence to determine the attackers' end goal. Second update: The first emergency patch was bypassed. Researchers at watchTowr and Huntress found multiple ways around it, and watchTowr identified a further authentication vulnerability in the process. PaperCut has released Emergency Patch Release 2, covering NG and MF versions 24, 25 and 26 on Windows, Linux and macOS. In the company's words, following further work with its internal security team and external researchers including Huntress and watchTowr, it has released an updated emergency patch that includes additional hardening beyond the original. Applying the first patch is not sufficient. The bypass techniques have not been described publicly.

PaperCut has warned that a vulnerability affecting all versions of PaperCut NG and PaperCut MF is being exploited.

The company's own words: it is aware of confirmed customer incidents and is treating the matter with the highest priority. Emergency patches have gone out for public-facing servers.

The indicators, and the problem with them

PaperCut lists what to look for:

  • Suspicious activity from the legitimate pc-app.exe process
  • Modified, deleted or missing server.log files
  • Errors reading ERROR No suitable driver found for jdbc:no:x
  • Errors reading ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

The second one deserves a moment. A missing log is not a sign of a problem elsewhere — it is the artefact itself. Somebody removed the record of what they did, and the hole where the record was is what you are hunting for.

That inverts how most people check. You cannot grep an absence. You have to know what should be there.

The line worth quoting

PaperCut states that a lack of indicators does not mean that a server has not been compromised.

Vendors do not usually say that. It is an admission that the indicator list is incomplete, and it is more useful than a confident checklist would be.

It is also the fourth time this month this site has written some version of the same sentence. An implant that unlinks EDR callbacks so the product stops being notified. A driver that deletes Defender before it can lock itself. Malware that whitelists its own folder. Now logs that are simply gone.

Silence is the common product. A clean environment and a thoroughly cleaned-up one look identical from the console.

Why PaperCut, again

Print management sits in an awkward place: it is deployed almost everywhere, it usually has a web interface, it talks to directory services and databases, and almost nobody thinks of it as security-relevant infrastructure. It is administrative plumbing with credentials.

The last time this mattered, CVE-2023-27350 was exploited by Clop and LockBit ransomware operations, by Iranian state-backed groups, and by the Bl00dy ransomware gang. That is an unusually broad cast for one product, and it happened because the install base is large and the servers are frequently internet-facing.

This one was reported by a university customer, and PaperCut's security team reproduced it.

What to do

  • Patch now, and treat public-facing servers as the priority. PaperCut has shipped emergency releases for them.
  • Restrict the web interface to trusted IP addresses, by firewall or network access control. This is PaperCut's own recommended mitigation and it is worth doing permanently, not just this week.
  • Check whether server.log exists and is continuous. A gap or an absence is the finding.
  • Search for those two error strings across your logs, including archived copies an attacker may not have reached.
  • Do not conclude you are clean because nothing matched. The vendor has said as much.
  • Get the server off the public internet if you can. Nothing about print management requires the world to reach it.

What is not established

  • The CVE identifier and CVSS score. Neither disclosed at the time of writing.
  • The attack vector and technical mechanism. Not published.
  • Who is exploiting it, and what they do afterwards.
  • Whether data has been stolen, as opposed to access obtained.
  • How many organisations are affected. No figure.
  • The full patch timeline and which versions carry the fix.