PaperCut’s emergency print-server patch still allowed an unauthenticated route to server code execution. In research published October 9, watchTowr’s Piotr Bazydlo demonstrates a new chain against PaperCut NG 26.0.4-PO build 76508: reach an administrator setup form without signing in, then use Scan to Fax to run commands on the server. Teams that deployed that interim build need to inspect their upgrade history and web-interface exposure, even if the server is now on a newer release.
PaperCut NG and MF manage organizational printing through a web administration interface. The vendor’s authentication-bypass record describes unauthenticated administrative actions; its database-connector record describes code execution after an attacker changes configuration. Those two flaws were exploited against 26.0.3. The October research adds a separate route through an interim patch.
Emergency builds changed the route
PaperCut released 26.0.4 on August 27 for the original chain. During patch analysis, watchTowr found two bypasses, WT-2026-0141 and WT-2026-0142, that together restored unauthenticated code execution on that release. PaperCut then issued 26.0.4-PO build 76508 on August 28. It repaired those bypasses, but watchTowr found another authentication bypass, WT-2026-0143, and a different code-execution flaw, WT-2026-0144 (CVE-2026-82077), in that build. In watchTowr’s words, they “enable a full unauthenticated RCE chain” on the then-current emergency release.
This sequence is why an emergency-patch receipt alone is a poor exposure timeline. The researchers date the WT-2026-0143 authentication-bypass fix to 26.0.4-PO build 76530 on September 1 and the Scan-to-Fax fix to 26.0.5 on September 10. PaperCut’s Scan-to-Fax CVE record lists affected NG/MF versions below 25.0.13 and the 26.0.0 line below 26.0.5; the earlier two records list their own affected version ranges. Check the applicable maintained branch against each record rather than assuming build 76530 fixed the later code-execution flaw.
A public page reached setup
PaperCut’s Apache Tapestry 3 service routing can name a public root page and another page’s form in one request. The authorization check applied to the root page. Bazydlo found that routing through the publicly accessible Home page could reach Setup Wizard forms while skipping the setup page’s validation, even after setup was complete. His team demonstrated a reset of the administrator password on build 76508. The system.setup-completed setting normally redirects a direct visit to those pages; this route bypassed that page-level check.
With administrator access, the researchers turned to Scan to Fax. Their analysis follows an attacker-controlled fax connector name into getAbsoluteBinaryPath, which joins it to the fax connector directory without constraining traversal. The application then executes the resolved program through ProcessUtils.execAndGetOutput; configurable fax command arguments complete the path to OS command execution. The vendor’s CVE-2026-82077 record describes the same flaw as authenticated command execution through crafted fax-provider settings. In combination with WT-2026-0143, the researcher reached it without a prior account. watchTowr sells an exposure-management platform and promotes it in this research.
Trace the exposed print servers
Start with the installed build and upgrade dates for the Application Server and any other reachable PaperCut web interfaces. Identify intervals on 26.0.4 or 26.0.4-PO build 76508, then compare firewall and proxy access during those intervals. Restrict the administration interface to trusted management addresses now; an unauthenticated visitor needs network access to reach the routing flaw. Confirm the installed release meets the applicable fixes, including 26.0.5 on the 26.x line or 25.0.13 on the 25.x line for the Scan-to-Fax CVE. For older lines, move to a vendor-supported release outside the CVE record’s affected range.
For servers that ran build 76508, search retained web access logs for a service value that routes from Home into SetupAdmin or another setup form. Correlate those with administrator-account changes, Scan-to-Fax configuration changes and unexpected child processes of the PaperCut Application Server. A matching access path warrants investigation; preserved history and process records matter more than a current version string for past exposure. watchTowr says its Detection Artifact Generator tests exposure to the authentication bypass, rather than executing the complete chain. The researchers describe the new route as a demonstration; the earlier PaperCut incident and its vendor indicators remain the starting point for known in-the-wild compromise.
Verify the build and access path
From a network outside the approved management range, the PaperCut web interface should receive a network-layer denial. On each affected server, verify the running release and inspect retained logs covering any interval on the bypassable builds. A current fixed build addresses the known path; any suspicious setup-form access or unexplained server child process calls for incident handling against the prior exposure window. The patch history tells you when the door was open. The access records tell you whether someone tried it.