Detect PaperCut NG/MF Unsafe Reflection RCE (CVE-2026-82078) in CrowdStrike LogScale
Detects exploitation attempts and successful exploitation of CVE-2026-82078, an unsafe reflection (CWE-470) vulnerability in PaperCut NG/MF print management software. The flaw allows an attacker to instantiate or invoke arbitrary Java classes by controlling reflection targets through user-supplied input to the PaperCut web application, leading to remote code execution. Added to the CISA KEV catalog on 2026-08-31 following active exploitation. This detection identifies suspicious requests to PaperCut web endpoints containing reflection/class-loading indicators, anomalous child processes spawned by the PaperCut application server (pc-app / java), and post-exploitation activity such as script/command execution originating from the PaperCut service account.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/pc-app\.exe|java\.exe|javaw\.exe/i
| ImageFileName=/.*PaperCut.*/i OR ParentImageFileName=/.*PaperCut.*/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|rundll32|mshta|bitsadmin|certutil|curl|whoami|net|reg)\.exe$/i
| table([_time, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(_time, order=desc)CrowdStrike CQL query identifying suspicious child processes descended from the PaperCut application server, a signal of successful reflection-based RCE.
Data Sources
Required Tables
False Positives & Tuning
- Admin-driven server-command maintenance scripts
- PaperCut custom scripting features executing OS commands
- Monitoring/backup agents under the PaperCut service context
Other platforms for CVE-2026-82078
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate PaperCut server spawning a command interpreter
Expected signal: Process-creation event with ParentImage ending in pc-app.exe and child process cmd.exe running whoami/hostname.
- Test 2Simulate reflection-based download utility execution on Linux PaperCut
Expected signal: Process-creation event showing a pc-app parent launching curl/whoami.
- Test 3Simulate web-shell drop into PaperCut web directory
Expected signal: File-creation event for a .jsp file under a PaperCut web directory written by the PaperCut/java process.
References (4)
- https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-82078
Response Playbook
Triage
- Confirm the PaperCut NG/MF version on the affected host and compare against the vendor security bulletin dated 27-Aug-2026 to determine whether it is a vulnerable release.
- Review the parent PaperCut process command line and the spawned child process command line to determine whether the execution is administrator-initiated (server-command) or anomalous.
- Correlate the process-creation event timestamp with PaperCut web/application access logs (server.log, web access logs) for suspicious requests immediately preceding the child-process spawn.
- Check whether the PaperCut admin console (default TCP 9191/9192) is exposed to the internet or untrusted networks, increasing exploitation likelihood.
Containment
- Isolate the affected PaperCut host from the network if post-exploitation command execution is confirmed.
- Block external access to the PaperCut admin/web ports (9191/9192/443) at the perimeter and restrict to management networks until patched.
- Apply the vendor-provided patch from the 27-Aug-2026 PaperCut security advisory or upgrade to a fixed NG/MF release.
Evidence Collection
- Preserve PaperCut server logs ([app-path]/server/logs/server.log and web access logs) covering the exploitation window.
- Capture the full process tree, command lines, and any dropped files (scripts, webshells) under the PaperCut installation and temp directories.
- Collect memory and disk artifacts from the PaperCut host, including the Java process command line and loaded classes if RCE is suspected.
Escalation Criteria
- !Escalate to incident response if a command interpreter, script host, or download utility was successfully spawned by the PaperCut application server.
- !Escalate if evidence of persistence, credential access, or lateral movement from the PaperCut service account is observed.
- !Escalate if the PaperCut instance was internet-exposed and exploitation indicators are present, given active KEV-listed exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PaperCut server.log entries showing reflection/class-loading exceptions or anomalous admin actions - >
Web/application access logs to PaperCut endpoints preceding child-process execution - >
Unexpected files under the PaperCut installation, temp, and web directories (scripts, JARs, web shells) - >
Process-creation telemetry showing pc-app/java spawning command interpreters
Tuning Guidance
Baseline legitimate uses of PaperCut server-command.exe and any custom print-script hooks in your environment, then exclude those specific command-line patterns and service accounts. If administrators regularly run scripted maintenance under the PaperCut context, allowlist known scripts by hash or path. Focus alerting on unexpected interpreters (powershell, cmd, wscript) and download utilities (certutil, curl, bitsadmin) that have no legitimate business being spawned by the print server.
Hunting Queries
Baselines and surfaces anomalous child processes of the PaperCut application server across the environment to identify exploitation outliers.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("pc-app.exe","java.exe","javaw.exe") | where InitiatingProcessFolderPath has "PaperCut" | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ descindex=* sourcetype=Sysmon EventCode=1 (ParentImage="*pc-app*" OR (ParentImage="*java*" AND ParentImage="*PaperCut*")) | stats count by Image, CommandLine, host | sort - countAtomic Red Team Tests
Renames a benign binary to mimic pc-app and launches cmd.exe to emulate the parent-child relationship produced by CVE-2026-82078 exploitation.
Command
copy C:\Windows\System32\cmd.exe %TEMP%\pc-app.exe && %TEMP%\pc-app.exe /c "whoami & hostname"Cleanup
del %TEMP%\pc-app.exeExpected Telemetry
Process-creation event with ParentImage ending in pc-app.exe and child process cmd.exe running whoami/hostname.
Expected Detection
KQL/EQL/CQL rules fire on the pc-app.exe -> cmd.exe parent-child relationship.
Emulates a Java application server invoking a download utility as post-exploitation on a Linux PaperCut host.
Command
bash -c 'cp /bin/bash /tmp/pc-app; /tmp/pc-app -c "curl -s http://127.0.0.1/ttest || whoami"'Cleanup
rm -f /tmp/pc-appExpected Telemetry
Process-creation event showing a pc-app parent launching curl/whoami.
Expected Detection
Process-lineage detections flag the PaperCut server process spawning a network download/recon utility.
Writes a benign marker file into a simulated PaperCut web root to emulate web-shell persistence after RCE.
Command
mkdir "%TEMP%\PaperCut\server\custom\web" 2>nul & echo <%%-- test --%%> > "%TEMP%\PaperCut\server\custom\web\test.jsp"Cleanup
del "%TEMP%\PaperCut\server\custom\web\test.jsp"Expected Telemetry
File-creation event for a .jsp file under a PaperCut web directory written by the PaperCut/java process.
Expected Detection
File-monitoring rules alert on new server-side script files created under the PaperCut web root.