CVE-2026-82078 IBM QRadar · QRadar

Detect PaperCut NG/MF Unsafe Reflection RCE (CVE-2026-82078) in IBM QRadar

Detects exploitation attempts and successful exploitation of CVE-2026-82078, an unsafe reflection (CWE-470) vulnerability in PaperCut NG/MF print management software. The flaw allows an attacker to instantiate or invoke arbitrary Java classes by controlling reflection targets through user-supplied input to the PaperCut web application, leading to remote code execution. Added to the CISA KEV catalog on 2026-08-31 following active exploitation. This detection identifies suspicious requests to PaperCut web endpoints containing reflection/class-loading indicators, anomalous child processes spawned by the PaperCut application server (pc-app / java), and post-exploitation activity such as script/command execution originating from the PaperCut service account.

MITRE ATT&CK

Tactic
Initial Access Execution

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT QIDNAME(qid) AS event, "Process Name" AS child, "Parent Process Name" AS parent, "Command Line" AS cmd, username, sourceip, destinationip, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOWER("Parent Process Name") LIKE '%pc-app%' OR (LOWER("Parent Process Name") LIKE '%java%' AND LOWER("Parent Process Path") LIKE '%papercut%')
AND LOWER("Process Name") IMATCHES '.*(cmd|powershell|pwsh|wscript|cscript|rundll32|mshta|bitsadmin|certutil|curl|whoami|net|reg)\.exe'
ORDER BY starttime DESC LAST 24 HOURS
critical severity medium confidence

AQL query returning suspicious child processes of the PaperCut application server captured in QRadar process-creation events.

Data Sources

Microsoft Windows Security Event LogSysmon

Required Tables

events

False Positives & Tuning

  • Administrator maintenance scripts via server-command
  • PaperCut print scripts invoking shell commands
  • Backup agents under the PaperCut account

Other platforms for CVE-2026-82078

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate PaperCut server spawning a command interpreter

    Expected signal: Process-creation event with ParentImage ending in pc-app.exe and child process cmd.exe running whoami/hostname.

  2. Test 2Simulate reflection-based download utility execution on Linux PaperCut

    Expected signal: Process-creation event showing a pc-app parent launching curl/whoami.

  3. Test 3Simulate web-shell drop into PaperCut web directory

    Expected signal: File-creation event for a .jsp file under a PaperCut web directory written by the PaperCut/java process.

Last updated: 2026-09-01 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the PaperCut NG/MF version on the affected host and compare against the vendor security bulletin dated 27-Aug-2026 to determine whether it is a vulnerable release.
  2. Review the parent PaperCut process command line and the spawned child process command line to determine whether the execution is administrator-initiated (server-command) or anomalous.
  3. Correlate the process-creation event timestamp with PaperCut web/application access logs (server.log, web access logs) for suspicious requests immediately preceding the child-process spawn.
  4. Check whether the PaperCut admin console (default TCP 9191/9192) is exposed to the internet or untrusted networks, increasing exploitation likelihood.

Containment

  1. Isolate the affected PaperCut host from the network if post-exploitation command execution is confirmed.
  2. Block external access to the PaperCut admin/web ports (9191/9192/443) at the perimeter and restrict to management networks until patched.
  3. Apply the vendor-provided patch from the 27-Aug-2026 PaperCut security advisory or upgrade to a fixed NG/MF release.

Evidence Collection

  1. Preserve PaperCut server logs ([app-path]/server/logs/server.log and web access logs) covering the exploitation window.
  2. Capture the full process tree, command lines, and any dropped files (scripts, webshells) under the PaperCut installation and temp directories.
  3. Collect memory and disk artifacts from the PaperCut host, including the Java process command line and loaded classes if RCE is suspected.

Escalation Criteria

  • !Escalate to incident response if a command interpreter, script host, or download utility was successfully spawned by the PaperCut application server.
  • !Escalate if evidence of persistence, credential access, or lateral movement from the PaperCut service account is observed.
  • !Escalate if the PaperCut instance was internet-exposed and exploitation indicators are present, given active KEV-listed exploitation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >PaperCut server.log entries showing reflection/class-loading exceptions or anomalous admin actions
  • >Web/application access logs to PaperCut endpoints preceding child-process execution
  • >Unexpected files under the PaperCut installation, temp, and web directories (scripts, JARs, web shells)
  • >Process-creation telemetry showing pc-app/java spawning command interpreters

Tuning Guidance

Baseline legitimate uses of PaperCut server-command.exe and any custom print-script hooks in your environment, then exclude those specific command-line patterns and service accounts. If administrators regularly run scripted maintenance under the PaperCut context, allowlist known scripts by hash or path. Focus alerting on unexpected interpreters (powershell, cmd, wscript) and download utilities (certutil, curl, bitsadmin) that have no legitimate business being spawned by the print server.

Hunting Queries

Baselines and surfaces anomalous child processes of the PaperCut application server across the environment to identify exploitation outliers.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("pc-app.exe","java.exe","javaw.exe") | where InitiatingProcessFolderPath has "PaperCut" | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=* sourcetype=Sysmon EventCode=1 (ParentImage="*pc-app*" OR (ParentImage="*java*" AND ParentImage="*PaperCut*")) | stats count by Image, CommandLine, host | sort - count

Atomic Red Team Tests

Test 1 Simulate PaperCut server spawning a command interpreter
windows

Renames a benign binary to mimic pc-app and launches cmd.exe to emulate the parent-child relationship produced by CVE-2026-82078 exploitation.

Command

powershell 
copy C:\Windows\System32\cmd.exe %TEMP%\pc-app.exe && %TEMP%\pc-app.exe /c "whoami & hostname"

Cleanup

powershell 
del %TEMP%\pc-app.exe

Expected Telemetry

Process-creation event with ParentImage ending in pc-app.exe and child process cmd.exe running whoami/hostname.

Expected Detection

KQL/EQL/CQL rules fire on the pc-app.exe -> cmd.exe parent-child relationship.

Test 2 Simulate reflection-based download utility execution on Linux PaperCut
linux

Emulates a Java application server invoking a download utility as post-exploitation on a Linux PaperCut host.

Command

bash 
bash -c 'cp /bin/bash /tmp/pc-app; /tmp/pc-app -c "curl -s http://127.0.0.1/ttest || whoami"'

Cleanup

bash 
rm -f /tmp/pc-app

Expected Telemetry

Process-creation event showing a pc-app parent launching curl/whoami.

Expected Detection

Process-lineage detections flag the PaperCut server process spawning a network download/recon utility.

Test 3 Simulate web-shell drop into PaperCut web directory
windows

Writes a benign marker file into a simulated PaperCut web root to emulate web-shell persistence after RCE.

Command

powershell 
mkdir "%TEMP%\PaperCut\server\custom\web" 2>nul & echo <%%-- test --%%> > "%TEMP%\PaperCut\server\custom\web\test.jsp"

Cleanup

powershell 
del "%TEMP%\PaperCut\server\custom\web\test.jsp"

Expected Telemetry

File-creation event for a .jsp file under a PaperCut web directory written by the PaperCut/java process.

Expected Detection

File-monitoring rules alert on new server-side script files created under the PaperCut web root.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections