Key points
- WatchTowr Labs disclosed four linked vulnerabilities in PaperCut products, including patch bypasses for previously assigned CVEs.
- The flaw chain enables remote code execution without authentication, posing a significant risk to exposed systems.
- PaperCut bundled multiple issues into single CVE IDs, complicating the tracking of specific fixes and bypass methods.
WatchTowr Labs published research on January 14, 2026, detailing a series of security flaws in PaperCut software that allow remote code execution without authentication. The report identifies four distinct vulnerabilities, labeled WT-2026-0141 through WT-2026-0144, which can be chained together by attackers. This chain enables unauthorized individuals to execute arbitrary code on affected systems, potentially gaining full control over the server hosting the printing management software.
In plain English
Attackers can exploit these flaws to take over PaperCut servers without needing a username or password. The vulnerabilities are severe because they do not require any initial access or credentials. Once an attacker executes code remotely, they can install malware, steal data, or disrupt printing operations across the organization. The term "pre-auth" means the breach happens before any user verification occurs, making it easier for automated attacks to succeed against exposed internet-facing systems.
The background
PaperCut assigned three CVE IDs to these issues: CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578. WatchTowr Labs noted that PaperCut bundled multiple vulnerabilities and their subsequent patch bypasses into these single identifiers. This bundling creates confusion for security teams trying to track specific fixes. The research highlights that previous patches were insufficient, as attackers found ways to bypass them, leading to the disclosure of additional flaws under the same CVE umbrella.
What changes now
Security teams must treat this as a high-priority incident due to the unauthenticated nature of the exploit. The disclosure of patch bypasses indicates that simply applying previous updates may not be enough to secure systems. Organizations using PaperCut MF or NG need to verify their current software versions against the latest vendor guidance. Until comprehensive fixes are confirmed and applied, exposed systems remain vulnerable to remote takeover by threat actors monitoring for these specific CVEs.
What to do and how to stay safe: PaperCut
- Audit your network to ensure PaperCut services are not directly accessible from the public internet without strict firewall rules.
- Review vendor advisories for CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578 to confirm if your current patch level addresses the bypasses.
- Monitor server logs for unauthorized code execution attempts or unusual process activity originating from the PaperCut application.
- Limit administrative access to PaperCut management interfaces to internal, trusted networks only.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific vulnerabilities are involved in this disclosure?
WatchTowr Labs identified WT-2026-0141 through WT-2026-0144, which correspond to CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.
Do attackers need a password to exploit this?
No, the vulnerabilities allow for pre-authentication remote code execution, meaning no credentials are required.
Why are there more WatchTowr IDs than CVE IDs?
PaperCut bundled multiple vulnerabilities and patch bypasses into single CVE assignments, creating a mismatch in counts.
