The Exploit Bulletin — Saturday, October 17, 2026: 1 issue requires action
Saturday, October 17, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: PaperCut NG/MF
1. Unauthenticated configuration change chained to pre-auth RCE in PaperCut NG/MF (CVE-2026-81578)
CISA KEV (due 2026-09-14) · REMOTE CODE EXECUTION · CRITICAL · CVSS 8.8
Hunt.io's 2026-10-15 report documented the attacker's exploit code and victims across 45+ countries, and a Metasploit module now exists, so any PaperCut NG/MF server still below the fixed builds should be treated as a target already being scanned for.
An admin-only Tapestry component in the PaperCut NG/MF web interface can be reached without authentication, letting a remote attacker modify system configuration. Chained with CVE-2026-82078 this gives unauthenticated remote code execution on the PaperCut application server, and PaperCut has confirmed customer incidents.
Affected: PaperCut NG/MF < 24.1.10; PaperCut NG/MF 25.0.0 – 25.0.12; PaperCut NG/MF 26.0.0 – 26.0.4 (including Emergency Patch Release 1–3 builds, which are superseded)
How to Test: Check the installed version in the PaperCut NG/MF admin interface: anything below 24.1.10, 25.0.13 or 26.0.5 — including the Emergency Patch Release builds — is affected. Review the application server's web access logs for unauthenticated requests reaching admin-only Tapestry component paths and look for configuration changes in the admin audit log that staff did not make; the Huntress, GreyNoise and Hunt.io reports list observed post-exploitation activity to compare against.
How to Patch: Upgrade to PaperCut NG/MF 26.0.5, 25.0.13 or 24.1.10 via the standard upgrade procedure; these maintenance releases replace Emergency Patch Releases 1, 2 and 3, so hosts on an emergency patch build must also move to a maintenance release. Until upgraded, restrict network access to the application server's web interface to trusted addresses.
Evidence: CISA KEV · VulnCheck KEV · Vendor confirmed · CISA SSVC: active · Hunt.io (2026-10-15): attacker toolkit, exploit code, victims across 45+ countries · Huntress: PaperCut actively exploited, pre-auth RCE chain
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
