PaperCut MF/NG - Authentication Bypass (CVE-2026-81578)

CVE-2026-81578 is a high-severity improper access control vulnerability in the PaperCut MF/NG web management interface. Under specific conditions, unauthenticated remote attackers can bypass access validation and invoke administrative backend actions, potentially modifying system configurations and disrupting or compromising the managed printing environment.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-81578 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-81578 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target the PaperCut web interface at /app, using Tapestry service requests such as /app?service=page/Error and /app?service=direct/<random>/Home/ConfigEditor/quickFindForm. The exploit abuses a complex-direct request to invoke the privileged ConfigEditor form listener without authentication, typically submitting parameters such as sp, Form0, $TextField, and doQuickFind.