PaperCut Patch Bypass: Scan2Fax to Pre-Auth RCE

On October 9, watchTowr disclosed a new authentication-bypass and Scan2Fax chain against an interim PaperCut release. It shows how patch bypasses restored a pre-auth path to a post-auth command-execution flaw; PaperCut's final fixes are 26.0.5/25.0.13.^{[1], [2]}

💡 Plain English Explainer (ELI5)

Imagine a building where each room checks a visitor's badge, but the lobby checks only the first room on a visitor's route. A shortcut through an open room can then reach a restricted desk without that desk checking the badge again. PaperCut's patch history had to close more than one such route; the final fix protects the forms themselves and the file path used by Scan-to-Fax.^[1]

Core Concepts & Subsystem Terms

Patch bypass: A different path reaches the same protected operation after a fix blocks only the originally reported route. It is a new defect in the boundary, not proof that the original patch was wholly absent.^[1]
Pre-authentication chain: A sequence where one flaw avoids the normal login check and a second flaw supplies an impact such as command execution. Each link has separate mechanics and must be described accurately.^[1]
CVE-2026-82077: PaperCut's Scan-to-Fax vulnerability is a path-traversal flaw that can lead to command execution by an authenticated administrator. PaperCut fixes it in 26.0.5 and 25.0.13; watchTowr showed how a separate interim-build authorization bypass could chain into it.^{[2], [3], [4], [1]}
WT-2026-0143: watchTowr's identifier for an authentication-bypass patch bypass disclosed October 9. PaperCut's public bulletin does not assign it a separate CVE. It was fixed in 26.0.4-PO build 76530.^[1]
Exploitation status: PaperCut reported in August that earlier PaperCut flaws were exploited in the wild. Its September bulletin says it had no evidence that the issues addressed there, including CVE-2026-82077, were exploited. The October 9 research demonstrates the chain on an interim build; it does not establish in-the-wild use of that newer chain.^{[5], [2], [1]}

Framework mappings

CWE reference for the weakness described in this guide: CWE-22 CWE-78

Release state: separate the two PaperCut chains

PaperCut release	What the sources establish	Defender action
26.0.3	watchTowr identifies this as the build involved in the earlier in-the-wild `CVE-2026-81578` + `CVE-2026-82078` chain.	Use PaperCut’s urgent advisory; treat this as the earlier exploited chain, not the October research chain.
26.0.4	watchTowr found separate patch bypasses while analyzing this release.	Do not treat an intermediate patch as the final state; follow the vendor’s fixed-release guidance.
26.0.4-PO build 76508	watchTowr reproduced WT-2026-0143 + `CVE-2026-82077` here. This is researcher-demonstrated, not evidence of customer exploitation.	Upgrade to a vendor-fixed release; do not infer this build is protected because it includes earlier emergency fixes.
26.0.4-PO build 76530	watchTowr says this fixed WT-2026-0143; `CVE-2026-82077` was fixed in a later release.	Continue to the final `CVE-2026-82077` fix; this interim bypass fix alone is insufficient.
26.0.5 / 25.0.13 or later	PaperCut lists these as the fixes for `CVE-2026-82077`.	Upgrade to the current supported release; verify the installed branch and build.
24.1.10 maintenance release	PaperCut’s August advisory lists 24.1.10 as a maintenance release replacing Emergency Patches 1–3.	This confirms the August fixes only; it does not establish `CVE-2026-82077` status.
24.x branch: `CVE-2026-82077`	PaperCut’s September bulletin names 26.0.5 and 25.0.13 (25.x) as fixed; it does not specify the 24.x branch.	Do not infer this CVE’s 24.x status; check PaperCut’s current branch guidance.

Incident Timeline

2026-08-27

PaperCut published an urgent notice about exploitation of PaperCut NG/MF. watchTowr later linked the earlier in-the-wild chain to CVE-2026-81578 and CVE-2026-82078; this is separate from the newly disclosed WT-2026-0143 plus CVE-2026-82077 chain.^{[5], [1]}

2026-08-28

PaperCut shipped 26.0.4 and then emergency build 26.0.4-PO 76508. watchTowr reports finding successive bypasses while analyzing those patches.^{[1], [5]}

2026-08-31 to 2026-09-10

watchTowr reported WT-2026-0143 and CVE-2026-82077 to PaperCut. PaperCut fixed WT-2026-0143 in 26.0.4-PO 76530 on September 1 and fixed CVE-2026-82077 in 26.0.5/25.0.13 on September 10.^{[1], [2]}

2026-10-09

watchTowr published the technical account of the interim-build chain. The disclosure is not evidence that this newer chain was used against customers.^{[1], [2]}

Step-by-Step Attack Flow

Step 1

A route-level permission check misses a nested destination

watchTowr describes PaperCut's legacy Tapestry routing, where a request can name a root page and a subsequent page/form. The earlier authorization check did not consistently enforce the destination form's own permission boundary.^[1]

Step 2

A patch bypass reaches a protected setup form

The 26.0.4-PO 76508 chain used WT-2026-0143 to reach setup functionality through a page whose validation did not invoke the destination form's check. This is a description of the authorization boundary, not a reproduction of the route or requests.^[1]

Step 3

Scan-to-Fax has a separate path-to-command flaw

PaperCut classifies CVE-2026-82077 as path traversal in Scan-to-Fax settings, allowing an authenticated administrator to execute commands on the host. watchTowr showed that the interim authorization bypass could supply the missing authenticated context.^{[1], [2]}

Step 4

Final releases close the disclosed chain

PaperCut fixed WT-2026-0143 in emergency build 76530 and CVE-2026-82077 in 26.0.5/25.0.13. The October disclosure does not mean those final releases remain vulnerable or that the new chain was exploited in the wild.^{[1], [2]}

Source Code: Flaw vs. Secure Implementation

This generic Java example shows two independent controls: authorize the privileged operation itself, then select an executable from a server-owned connector map and verify its canonical path. It is not PaperCut source or the vendor patch. Production code must also validate arguments, constrain process privileges, and use the fixed PaperCut release; path checks alone do not repair a page-routing authorization bypass.

UNPATCHED FLAW

Path executable = faxDirectory.resolve(clientConnectorName).normalize();
// A route-level check is not a substitute for authorizing this operation.
new ProcessBuilder(executable.toString(), faxArguments).start();

HARDENED SECURE PATCH

if (!principal.canAdministerFax()) {
    throw new SecurityException("Fax administration is required");
}
Path root = faxDirectory.toRealPath();
Path executable = approvedConnectors.get(connectorId); // Server-owned allowlist.
if (executable == null) {
    throw new IllegalArgumentException("Unknown connector");
}
Path resolved = executable.toRealPath();
if (!resolved.startsWith(root) || !Files.isExecutable(resolved)) {
    throw new SecurityException("Connector is outside the approved directory");
}
new ProcessBuilder(resolved.toString(), validatedArguments).start();

Engineering & System Hardening Checklist

✓Upgrade PaperCut NG/MF to 26.0.5 or later, or 25.0.13 or later on the 25.x branch. Do not treat interim build 76508 as the final fix; PaperCut's security bulletin names the final fixed releases.^{[2], [4]}
✓If an affected or interim build was exposed, follow PaperCut's current security bulletin and incident-response guidance; do not infer that the October research proves compromise or active exploitation of WT-2026-0143/CVE-2026-82077.^[2]
✓Authorize every destination page and form at the operation boundary. Add tests for direct and nested routing so an allowed root page cannot invoke a protected destination without its own authorization check.^[1]
✓Do not derive executable paths from request-supplied connector names. Map stable identifiers to server-configured executables, canonicalize paths, and reject any resolved executable outside the approved connector directory.^{[1], [2]}
✓Keep authentication-bypass fixes and command-execution fixes as separate controls in code review and release notes; verify both paths are covered by regression tests after framework or routing changes.^[1]
✓When reviewing advisories, distinguish the earlier exploited CVE-2026-81578/CVE-2026-82078 chain from the later patch-bypass research. Attribute observed exploitation, researcher reproduction, and vendor fixed-version claims to their respective sources.^{[1], [2]}