PaperCut flaws let attackers modify server configurations

At a glance

What this is: NHI Mgmt Group's analysis, drawing on runZero's report: PaperCut vulnerabilities let attackers modify server configurations through access-control failure and unsafe class loading.

Why it matters: Print servers often sit inside trusted network paths and hold administrative power, so flaws in their management plane can become a broader foothold for privilege abuse and lateral movement.

By the numbers:

• CVE-2026-81578 is rated high with a CVSS score of 8.8.
• CVE-2026-82078 is rated critical with a CVSS score of 9.4.
• PaperCut says its products reach over 130 million users across almost 90,000 organizations, according to the bulletin cited by runZero.

Context

PaperCut NG and PaperCut MF are print management platforms that sit close to administrative workflows, device control and user data. When those systems are exposed to untrusted networks, flaws in the management plane can turn routine print administration into a high-impact security problem.

The first flaw is an access-control failure in the web management interface, where backend actions can execute before validation completes. That pattern matters because administrative interfaces are often trusted by default, even though they govern settings that affect the wider environment.

The second flaw is unsafe dynamic class loading in database connection utilities, which gives a privileged attacker a path to manipulate configuration through crafted driver selection. In environments with privileged print servers, that is an atypical but serious escalation path.

Key questions

Q: How should teams secure public print servers?

A: Public print servers should be placed behind firewalls, exposed only on trusted networks, and limited to the management ports and protocols they actually need. Secure them with strong administrator authentication, patched print services, and disabled anonymous access or unnecessary web consoles. Treat print queues, device configuration, and job routing as sensitive attack surfaces.

Q: Why do management interface flaws lead to configuration tampering?

A: Management interface flaws let an attacker reach admin functions without proper authorisation, so they can change settings, create accounts, alter workflows, or disable controls. Weak session handling, missing access checks, and direct object manipulation often expose privileged backend actions. Segregating the interface, enforcing strong authentication, and checking every state-changing request reduce that tampering path.

Q: How does unsafe dynamic class loading create risk?

A: Unsafe dynamic class loading lets an application choose and instantiate code at runtime from data that should never control execution paths. If configurable values influence the class name or package, an attacker can redirect loading to unexpected code, causing remote code execution, privilege abuse, or unstable behaviour. Restrict loaders to allowlisted classes and signed components.

Q: What are the signs that exploitation of a print management server may be underway?

A: Useful warning signs include unexpected behavior on the server, traffic to unusual external IP addresses, and large outbound transfers that do not fit normal printing or administration patterns. Security teams should also watch for PowerShell activity, downloads from suspicious domains, and communications with infrastructure already associated with malware or ransomware operations.

Technical breakdown

Improper access control in the management interface

An access-control flaw at the management layer means a request can reach privileged backend logic before the system finishes checking whether the caller is allowed to use it. In practice, the dangerous part is not simple page exposure. It is that administrative actions are already wired into the request flow, so a race or sequencing defect can let an unauthenticated caller influence state-changing operations. That is a classic management-plane weakness: the interface is meant to gate admin actions, but the enforcement point arrives too late. See the IAM and IGA Basics.

Practical implication: Treat administrative interfaces as privileged attack surfaces and verify that authorization is enforced before any state-changing backend action runs.

Unsafe dynamic class loading in database utilities

Dynamic class loading lets an application instantiate code by name at runtime. That can be legitimate when the class list is tightly controlled, but it becomes dangerous when driver names are accepted from configuration without an allowlist. In that case, the runtime trusts a name field too much and can be steered into loading unexpected classes. For server software that touches databases, the issue is not only code execution risk. It is also configuration abuse through a privileged execution path that was assumed to be internal and safe.

Practical implication: Restrict runtime class selection to a strict allowlist and review any code paths that turn configuration values into executable behaviour.

Why print servers become privilege amplifiers

Print servers often sit inside the network as shared infrastructure, which means they aggregate administrative trust, device control and user interaction. That makes them attractive not only to remote attackers but also to anyone who can reach the management plane after initial foothold. Once a print server is compromised, the security impact can extend beyond printing because the server may hold configuration details, credentials or paths to adjacent systems. The architectural problem is that operational convenience creates a privileged service with broad reach and limited scrutiny. See the Remote Access Identity Guide.

Practical implication: Classify print infrastructure as privileged service infrastructure and apply the same exposure, segmentation and monitoring discipline used for other high-trust servers.

Threat narrative

Attacker objective: The attacker wants to change trusted server configuration and use that access to gain durable control over the print management system.

1. Entry occurs through a remotely reachable management interface or configuration path that was expected to enforce access control before privileged logic ran.
2. Credential or privilege boundaries are then bypassed when backend actions or class-loading behaviour execute with more trust than the requester should have.
3. Escalation follows when the attacker uses the flaw to modify system configurations on the PaperCut server.
4. Impact is achieved by taking control of the print server configuration, with potential full compromise of the underlying server.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Print management systems behave like privileged infrastructure, not ordinary peripheral software. PaperCut servers sit in a trusted position between users, devices and administrative workflows, so a control failure there can have outsized consequences. That is why management-plane security needs the same scrutiny as directory services, remote access and other high-trust systems. The practitioner takeaway is simple: if a print server can alter configuration, it must be governed like a privileged service.

Configuration-driven execution becomes a security liability when the validation boundary is weak. Unsafe dynamic class loading is not just a coding flaw. It is a governance failure that lets runtime behaviour depend on untrusted or insufficiently constrained configuration values. In identity and access terms, that means the system is effectively delegating trust to a field that should have been tightly controlled. The control gap is not patching alone but the absence of strict runtime allowlisting.

Administration interfaces need pre-authentication enforcement, not post-authentication assumptions. The access-control flaw here shows what happens when backend actions can fire before authorization completes. This is the same class of failure that affects many management consoles, where the interface looks protected but the execution path is not. For security programmes, the lesson is to treat every admin endpoint as a potential privilege boundary and validate the enforcement point, not just the login page.

Attackers target shared infrastructure because it offers concentrated operational reach. A print server that is reachable across the enterprise can become a pivot point even when the original issue is not identity-specific. In a broader governance sense, this is why service exposure, segmentation and privilege containment matter together. The security problem is not only whether the server is patched, but whether it was ever allowed to sit in a position where one flaw could affect many systems.

Management-plane compromise creates a trust cascade across adjacent services. Once attackers can change configurations on a server that brokers device and user workflows, they may be able to influence downstream access, logging or operational integrity. That is a control design issue as much as a vulnerability issue. The practitioner conclusion is to reduce standing trust in shared infrastructure and assume compromise of a privileged service will spread operationally before it is contained.

What this signals

Management-plane exposure is the real risk signal here. When administrative interfaces are reachable beyond the trusted network, the security model shifts from controlled operations to opportunistic abuse. The priority is to reduce the reachable attack surface before a flaw in request sequencing or runtime loading turns routine administration into configuration tampering.

Pre-authentication enforcement needs to be validated as a control, not assumed as a design intent. Many server products expose administrative workflows that look protected but still allow backend effects to occur too early. That is why security teams should test the enforcement point itself and not rely on the presence of a login screen as evidence of control.

High-trust infrastructure deserves continuous discovery and faster containment. Print servers are often overlooked until they become an incident path. If they are part of the enterprise trust fabric, they should be discovered, patched and segmented with the same urgency as other shared services that can affect many users at once.

For practitioners

• Harden public exposure of print servers Restrict any internet-reachable PaperCut instance to trusted IP ranges and remove unnecessary external reachability from the management plane.
• Patch all PaperCut components together Update primary servers, site servers and secondary print servers to the latest Emergency Patch Release 2 or later so the fix coverage is complete.
• Inventory every PaperCut deployment Search for both PaperCut NG and PaperCut MF across software and services inventory so no affected server is missed during remediation.
• Review administrative request enforcement Test whether administrative requests are blocked before backend actions execute, especially on web management interfaces that change system configuration.
• Constrain runtime class loading Replace free-form driver selection with a strict allowlist and review any database utility that instantiates classes from configurable names.

Key takeaways

• The vulnerabilities affect the control plane of a trusted print system, which means attackers can move from access to configuration change rather than simple disruption.
• PaperCut confirmed active exploitation, and the bulletin gives two distinct paths: pre-validation backend action execution and unsafe dynamic class loading.
• The most effective limit is to reduce exposure, patch all related server roles together and verify that administrative requests cannot reach privileged code before authorization completes.

Related NHI Mgmt Group resources: PaperCut Hardening Guide · IAM and IGA Basics · Authorisation Models Guide · Network Access Control (NAC) Guide

Key terms

• PaperCut NG: PaperCut NG is a server-based print management application used to track and control printing workflows. In security analysis it matters because the application sits close to administrative settings, user data and device control, so a flaw in its management plane can have enterprise-wide impact.
• Privileged Infrastructure: Privileged infrastructure is the core technical environment that holds elevated control over systems, such as identity platforms, hypervisors, cloud management planes, domain controllers, and orchestration layers. It is trusted to administer other assets, so compromise of its accounts, credentials, or consoles can expose broad administrative access and control paths.
• Improper Access Control: Improper access control is a weakness where a system fails to enforce who may access a function, resource, or action. In practice, it can let unauthenticated or underprivileged users bypass checks and perform tasks they should never reach. This often becomes severe when the affected component manages high-value security controls or administrative functions.
• Dynamic Class Loading: Dynamic class loading is the runtime loading of a software class into a program after the application has started. It is used in languages and platforms that resolve classes on demand, often through reflection, plug-ins, or custom class loaders, which changes what code is available at execution time and can affect control over behaviour and trust.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners connect privileged infrastructure risk to the identity controls their programmes already depend on.