Rapid7’s Metasploit Framework is set to add an exploit module targeting the actively exploited chain of vulnerabilities affecting PaperCut MF and PaperCut NG. This addition will provide public offensive tooling for a security emergency involving print management servers.
The proposed module targets CVE-2026-81578 and CVE-2026-82078, two vulnerabilities that attackers can exploit to achieve remote code execution on vulnerable PaperCut Application Servers.
The contribution for this module has been submitted as pull request #21842, which remains open and has received an approving review. It encompasses 845 lines of code across four files and supports PaperCut MF and NG releases 24.x, 25.x, and 26.x.
The module is named `multi/http/papercut_ng_external_user_lookup_rce`. It includes documentation along with a version-based check routine to assist authorized defenders in identifying vulnerable instances.
CVE-2026-81578 is an authentication-bypass issue in the web management interface, with a severity rating of 8.8. It allows unauthenticated remote requests to access backend administrative actions and modify configuration settings.
CVE-2026-82078, rated as critical at 9.4, is an unsafe dynamic class-loading flaw in PaperCut’s database connection utilities. Together, these vulnerabilities can be used to alter external user-lookup configurations and execute code in the context of the PaperCut server process.
Rapid7 has indicated that these vulnerabilities were reported as a zero-day exploit chain actively being used in the wild last week. PaperCut has also confirmed incidents affecting customers and stated that all versions of PaperCut NG and MF are potentially vulnerable.
The immediate risk is especially high for Application Servers with web interfaces exposed to the public internet, as the exploit chain starts with direct web access.
According to the pull request, the module supports platform-agnostic Java payloads and command payloads for Windows and Linux.
Java payload handling varies by product branch: on version 26.x, the module executes Java payloads in memory, while versions 25.x and earlier require a helper class due to differences in available execution primitives.
The contributor has tested the module against PaperCut MF 26.0.4 and PaperCut NG 24.1.9 and notes that while older, unsupported releases may also be affected, they were not specifically tested.
The module is reported to bypass PaperCut’s first emergency patch; however, Rapid7 has verified that the vendor’s second emergency patch effectively remediates the exploit path.
This distinction is crucial: organizations that only installed the initial emergency update are not adequately protected and should implement Emergency Patch Release 2 immediately.
PaperCut released the second patch for versions 24, 25, and 26 following comprehensive analysis with internal staff and external researchers.
Administrators should restrict PaperCut web access to trusted IP ranges, apply Release 2 to primary Application Servers and any relevant secondary servers, and investigate any signs of compromise.
PaperCut has listed several warning signs, including suspicious `pc-app` child processes, missing or truncated `server.log` files, unusual database-driver errors, unexpected class or command files, indicators from SimpleHelp’s “Remote Access Service,” and unplanned AnyDesk installations.
The availability of Metasploit will reduce barriers to reliable exploitation, making rapid mitigation and threat hunting essential for all exposed PaperCut deployments.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
