# PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

Unauthenticated attacker abuses page/component authorization mismatch in PaperCut web management to alter config, then unsafe dynamic class-loading in DB utilities to execute Java bytecode pre-auth.

- Payout: Real-world hack
- Severity: critical
- Program: PaperCut NG/MF
- Credited: Huntress
- Disclosed: 2026-08-28
- CVE: CVE-2026-81578, CVE-2026-82078
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/papercut-actively-exploited
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained vuln:access-control vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** PaperCut Application Server web management interface and database connection utilities
**Root cause:** A crafted request references one page for rendering while another page owns the executed component/action, so the authorization check trusts the rendered page and misses the permissions of the actual component. Separately, database connection utilities perform unsafe dynamic class-loading, allowing arbitrary Java bytecode execution.
**Steps:**
1. Send unauthenticated crafted request where rendered page differs from the page owning the executed component/action, bypassing access control to modify server configuration (`CVE-2026-81578`).
2. Use modified configuration to reach sensitive endpoints that trigger unsafe dynamic class-loading in DB connection utilities (`CVE-2026-82078`).
3. Supply attacker-controlled Java `.class` bytecode (observed dropped to `server/lib/Udydn.class`) loaded via a JDBC URL such as `jdbc:derby:memory:pwn`.
4. Bytecode executes as SYSTEM under `pc-app.exe`; observed payload runs `whoami & ver` (and `whoami & ver & tasklist`), writes output to `/data/content/Udydn.out`, then deletes output and `server.log`.
5. Confirm via `derby.log` entry `Booting Derby version ... on database directory memory:...\data\internal\pwn`.
**How found:** Huntress observed exploitation in customer environments via server.log artifacts: base64-encoded commands (`d2hvYW1pICYgdmVy` = whoami & ver) and a hex-encoded Java .class file dropped to server/lib. Decompiling with Fernflower revealed the payload's behavior; derby.log breadcrumb `jdbc:derby:memory:pwn` confirmed the class-loading vector. They then reproduced the full chain on stock PaperCut NG 25.0.11.75758.
**Exploitation:** Unauthenticated attacker sends crafted request to the PaperCut Application Server web interface to modify trusted configuration, then leverages the DB connection utility class-loading to load attacker-supplied Java bytecode, achieving code execution as SYSTEM under pc-app.exe. Observed payloads ran OS discovery commands (whoami, ver, tasklist), wrote results to a file, and deleted logs and themselves.
**Escalation:** Chained two flaws: access-control bypass to modify config enables reaching the unsafe class-loading sink, escalating from unauthenticated config change to full pre-auth RCE as SYSTEM.
**Insight:** When a framework renders one page but dispatches an action/component owned by another, authorization may check the wrong object — look for request parameters that decouple the rendered view from the executed handler. Also watch JDBC/connection-string sinks that dynamically load classes: a controllable JDBC URL (e.g. Derby `memory:` name) can be a code-execution primitive.