Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr chains PaperCut bugs into pre-auth RCE and shows patch bypasses for CVE-2026-82077, CVE-2026-82078 and CVE-2026-81578.
Extract
Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper! It still exists. We have to admit it - so much is happening right now (F1, GTA6, breakfast) that we barely have time to lovingly tease our most favoritest vendors. On Thursday, 27 August 2026, PaperCut published an advisory claiming that a mysterious vulnerability was being exploited in-the-wild, leading to system compromise. The watchTowr Intel team has documented the in-the-wild exploitation that our global honeypot network, Attacker Eye, captured here . To add insult to injury, when PaperCut released their advisory, they did so without a patch. Unlike other vendors that struggle to communicate at all, PaperCut provided IOCs in the form of log snippets related to exploitation and temporary mitigations, enabling their customers to take action. That said, much of the information remained unclear. How many vulnerabilities were exploited in this chain? Did any of them require authentication? Were the attackers exploiting post-authentication vulnerabilities? Which components were vulnerable? As mere mortals, we knew absolutely nothing at this point. A familiar feeling. PaperCut is no stranger to the exploitation of vulnerabilities in the wild. They've had their fair share of ransomware gang attention and, of course, live to tell the tale with their CISA KEV trophy. What is PaperCut? For those unaware, PaperCut is print management software that helps organizations monitor, control, and secure printing across their networks. Its core features include print quotas, secure release printing (a job is released only after the user logs in at the printer), cost tracking, and detailed reporting. Together, these cut printing costs, reduce paper waste, and prevent unauthorized use. It is widely used by schools, universities, healthcare providers, government agencies, law firms, and businesses of all sizes. That mix makes it an attractive target for APTs and ransomware gangs, as proven by several vulnerabilities previously exploited in the wild (such as CVE-2023-27351 and CVE-2023-27350). TL;DR Timeline There was a lot happening between 27 August and 1 September, so let us give you the full timeline, including some spoilers. Author's note: even though CVEs were assigned after two …
Explained
What happened
On 27 August 2026 PaperCut, a print management server common in schools, hospitals and government, warned that attackers were exploiting version 26.0.3, with no patch yet. watchTowr rebuilt the chain from the published log IOCs, then kept breaking each fix:
- In the wild: an authentication bypass,
CVE-2026-81578, plus a post-auth RCE through a controllable JDBC connection URL,CVE-2026-82078. - Patch 1,
26.0.4: watchTowr bypassed both fixes again, tracked as WT-2026-0141 and WT-2026-0142. - Patch 2, build
76508: another auth bypass, WT-2026-0143, plus a brand new RCE,CVE-2026-82077. - PaperCut finally closed them in build
76530and26.0.5on 10 September.
The auth bypass family lives in Apache Tapestry 3, a framework obsolete for about 20 years. A request like service=direct/1/Home/SetupAdmin/$Form names a public root page, then a protected page and form. PaperCut only ran the pageValidate authorization check on the root page. Patches added checks to specific pages like ConfigEditor, but missed the Setup Wizard. Four POSTs through Home replay the first-run setup and reset the admin password, even on a configured server.
The new RCE abuses Scan to Fax. The providerConnector field is joined to the fax connector directory with no validation, so ..\..\Windows\System32\cmd is a relative path traversal to any binary. The admin then sets system.scan.fax.send.command-args to /c whoami and triggers a fax job.
Why it works
Authorization was per page, not per request. When a framework lets one URL dispatch through several components, checking only the first one leaves every nested component exposed. Each patch blocked one path instead of adding a global check, so the next unchecked page reopened the hole. On the RCE side, a feature that runs OS commands took a user-supplied executable name.
The bigger pattern
This is incomplete patching under exploitation pressure: point fixes for a design flaw, followed by patch diffing that shows attackers exactly where to look. It mirrors earlier watchTowr work on SolarWinds Web Help Desk and its WebObjects framework. Legacy frameworks that few people still understand are where authorization assumptions hide.
What it means in practice
- Put authorization in one central place that runs for every request and every dispatched handler, deny by default. Do not rely on each controller remembering to check.
- Treat first-run setup and admin bootstrap flows as dangerous. Disable them for good once setup completes, not just with a redirect.
- Never build a command path or binary name from request input. Allowlist executables.
- Assume each emergency patch gets diffed within hours. If a fix is a narrow blocklist, plan for a bypass and keep mitigations such as network isolation in place.
- Keep internal admin tools like print servers off the internet and watch for odd
service=parameters in logs.