PaperCut Authentication Bypass and Dynamic Class Loading: Pre-authentication RCE Chain Actively Exploited

1. Basic Information

• Article Title: PaperCut releases second emergency patch for exploited flaws
• Source: BleepingComputer
• Published Date: August 28, 2026
• Original Article: BleepingComputer
• Related Sources: PaperCut urgent security advisory, Huntress, The Record, SecurityWeek, SecurityWeek - active intrusions
• Related Malware / Threat Groups / CVEs / Products: CVE-2026-81578, CVE-2026-82078, PaperCut MF, PaperCut NG
• Severity: Critical
• Reason for Update: PaperCut and SecurityWeek confirmed that exploitation progressed from the reconnaissance phase to hands-on-keyboard intrusions, involving the deployment of SimpleHelp and AnyDesk, internal domain enumeration, Release 3 availability, and CISA KEV inclusion.

2. Executive Summary

The unauthenticated RCE chain in PaperCut MF/NG has evolved into active intrusions. After enumerating the domain and users via pc-app.exe, attackers installed SimpleHelp as an automatic startup service running under LocalSystem, and also retrieved AnyDesk. Systems exposed during the vulnerable period must be investigated under the assumption of compromise, in addition to applying Release 3.

3. Attack Flow

From Unauthenticated RCE to Remote Access Persistence

1. An unauthenticated attacker chains an authentication bypass and dynamic class loading in the PaperCut management functionality.
2. The attacker launches cmd.exe with pc-app.exe privileges and checks the environment using whoami, ver, and tasklist.
3. The attacker enumerates the domain controller and users using nltest /dclist:, quser, and dir c:\users.
4. The attacker downloads and executes ace.exe via PowerShell, installing the SimpleHelp agent as a Remote Access Service running under LocalSystem with automatic startup.
5. The attacker also retrieves AnyDesk.exe to prepare an alternative remote access path.

4. Attacker Position and Execution Context

• An attacker who reaches the target product and exploits vulnerable features or improper permission boundaries.
• Operations are performed with application privileges or elevated privileges after successful exploitation.

5. Visibility for Victims and Administrators

Victims

• Exploitation occurs without user interaction, making it difficult to detect compromises based solely on printing functionality.

Administrators

• A rapid chain of execution originating from pc-app.exe to cmd.exe, whoami, tasklist, nltest, quser, and PowerShell occurs within approximately 30 minutes.
• Presence of SimpleService.exe and Remote Access Service under C:\ProgramData\JWrapper-Remote Access.
• Presence of C:\ProgramData\AnyDesk.exe, network traffic to sendit.sh, and missing or modified server.log with known strings.

6. Success and Failure Conditions

Success Conditions

• Reachable management interface.
• Unpatched against both authentication bypass and dynamic class loading.
• The server successfully loads the attacker's Java class.

Failure Conditions / Risk Mitigation

• Apply Emergency Patch Release 3 to Application Servers, Site Servers, and secondary/print servers.
• Restrict PaperCut web interfaces to trusted IP addresses and VPNs only.
• Block the execution of shells/PowerShell from pc-app.exe and the installation of remote access tools using EDR.

7. What Happens Upon Success

• Remote code execution with SYSTEM privileges on the PaperCut server.
• Persistent remote access via the SimpleHelp LocalSystem service.
• Additional remote access channels established via AnyDesk.
• Domain controller and user enumeration followed by internal network lateral movement.

8. Observable Logs

• Email: None.
• Proxy/SWG/DNS: Network traffic from pc-app.exe or PowerShell to sendit.sh and download.anydesk.com.
• Endpoint/EDR: pc-app.exe → cmd.exe → whoami/tasklist/nltest/quser/PowerShell, SimpleService.exe, AnyDesk.exe.
• Identity/IdP: nltest /dclist:, quser, and new logon events following the installation of the Remote Access Service.
• SaaS/Cloud: For cloud deployments, review WAF, load balancer, EDR, and PaperCut audit logs.
• Network: Domain controller enumeration originating from PaperCut, unknown remote access destinations, and outbound connections to internal hosts.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): External requests or known errors observed, but child processes not confirmed.
• User Interaction Confirmed: No user interaction required.
• Initial Execution Confirmed: cmd.exe and environment check commands spawned from pc-app.exe.
• Malware Execution or Authentication Success Confirmed: Execution of SimpleHelp/AnyDesk or established remote sessions confirmed.
• Information Theft or Session Compromise Confirmed: The acquisition of credentials, files, or sessions is outside the scope of publicly confirmed information.
• Post-Exploitation Confirmed: Remote Access Service persistence, domain enumeration, and internal pivoting confirmed.

10. Investigation Playbook

• Trigger: Shell execution from pc-app.exe, known server.log strings, or installation of SimpleHelp/AnyDesk.
• Initial Check: Verify exposure period, product version, Release 3 application timestamp, initial HTTP source IP, and missing server.log.
• Endpoints: Preserve child processes of pc-app.exe, C:\ProgramData\ace.exe, JWrapper-Remote Access, AnyDesk.exe, and associated services.
• Authentication & Cloud: Investigate domain authentication following nltest/quser, service accounts, administrator sessions, and credential usage.
• Post-Exploitation Activity: Check for remote access sessions, internal connections, file access, and tool deployment to other hosts.
• Containment: Isolate the server, apply Release 3, stop the Remote Access Service/AnyDesk, and revoke related credentials and sessions.
• Classification: Distinguish between connection attempts, RCE, environment enumeration, remote tool deployment, remote sessions, and internal lateral movement.

11. Defense and Detection Ideas

• Single Event: pc-app.exe spawns cmd.exe, PowerShell, nltest, or quser. A Remote Access Service is added to the PaperCut server with LocalSystem privileges and automatic startup.
• Sequential Correlation: Correlate RCE artifacts → environment checks → domain enumeration → sendit.sh download → SimpleHelp service installation → AnyDesk acquisition.
• Threat Hunting: Search all servers for pc-app.exe process trees during the exposure window, along with related services, ProgramData artifacts, and Web/EDR/network logs.
• Log Gaps: In the absence of server logs or EDR deployments, determining the progression stage requires network, service, and Windows event logs.
• Priority Actions: Apply Release 3, restrict public exposure, conduct compromise-assumption investigations, remove remote access tools, and rotate credentials.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-81578 allows unauthenticated attackers to reach backend management operations and modify settings prior to authentication verification.
• CVE-2026-82078 fails to restrict database driver class names via a whitelist, allowing the execution of Java bytecode present on the classpath.
• Huntress confirmed exploitation across two customers, observing command execution with SYSTEM privileges from pc-app.exe, placement of Udydn.class / Moo97.class, and deletion of server.log.
• Initial emergency fixes left multiple bypass paths, prompting PaperCut to release Release 2 for v24, v25, and v26.
• PaperCut disclosed hands-on-keyboard activity where pc-app.exe sequentially executed whoami & ver, tasklist, nltest /dclist:, quser, and dir c:\users.
• Attackers retrieved ace.exe from sendit.sh, installed the SimpleHelp agent as a Remote Access Service running under LocalSystem with automatic startup, and subsequently retrieved AnyDesk.exe.
• PaperCut released Emergency Patch Release 3 for v24, v25, and v26 to resolve regressions involving SAML and legacy Microsoft SQL Server, and to introduce additional hardening.
• CISA added CVE-2026-81578 and CVE-2026-82078 to its KEV catalog, setting a compliance deadline of September 14, 2026, for U.S. federal agencies.

Inference

• Systems that remained unpatched while exposed to the internet should not be considered secure through patch application alone; investigations for remote access tools and internal reconnaissance are required.

Hypothesis

• Attackers may have selected compromised hosts as an initial access broker, but attribution and ultimate objectives remain unconfirmed.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): Chained authentication bypass and dynamic class loading in internet-accessible PaperCut MF/NG instances.
• T1059.003 Command and Scripting Interpreter: Windows Command Shell (High): Spawned cmd.exe from pc-app.exe to execute commands such as whoami, tasklist, nltest, and quser.
• T1070.004 Indicator Removal: File Deletion (High): Huntress observed instances where attackers deleted PaperCut's server.log.
• T1219 Remote Access Software (High): Deployed SimpleHelp as an automatic startup service running under LocalSystem and acquired AnyDesk.

14. Unknowns and Additional Investigation

• Total number of compromised organizations, post-installation activities involving SimpleHelp/AnyDesk, and the scope of data access.
• Existence of any new bypass methods in environments where Release 3 is applied.

15. Impact on SOCs and Organizations

Organizations that exposed PaperCut instances externally must update to Release 3 and retroactively check for cmd.exe, nltest, PowerShell, SimpleHelp, AnyDesk, and Remote Access Service executions spawned under pc-app.exe. If systems were vulnerable during the exposure window, remediation cannot rely solely on applying patches; instead, treat the environment as compromised, isolate systems, rotate credentials, and investigate lateral movement.

16. Summaries by Target Audience

• For SOCs: Search for the ~30-minute attack chain: pc-app.exe → cmd.exe → nltest/quser → PowerShell download → SimpleHelp service → AnyDesk.
• For Administrators: Apply Release 3 to all Application, Site, and secondary servers; restrict exposure scope; and inspect for unauthorized Remote Access Services and unexpected AnyDesk installations.
• For End Users: Report any print system anomalies or unfamiliar remote access activity to the IT management department.