Key points
- WatchTowr Labs identified four vulnerabilities in PaperCut MF enabling unauthenticated remote code execution.
- The vendor assigned three CVE IDs to the issues, bundling flaws and patch bypasses into single identifiers.
- The research highlights specific watchTowr IDs (WT-2026-0141 to WT-2026-0144) alongside the assigned CVEs.
WatchTowr Labs published a detailed analysis of a vulnerability chain in PaperCut MF software that allows attackers to execute code remotely without authentication. The report, titled "Death By A Thousand PaperCuts," outlines how multiple flaws can be chained together to compromise systems. Security teams should note that the vendor’s patching approach bundles distinct vulnerabilities and their corresponding bypasses into single Common Vulnerabilities and Exposures identifiers, creating confusion for remediation efforts.
By the numbers
- Four distinct vulnerabilities were identified by WatchTowr Labs, labeled WT-2026-0141 through WT-2026-0144.
- Three CVE IDs were assigned by PaperCut for these issues: CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.
- The research indicates that patch bypasses for the initial vulnerabilities are included within the same CVE assignments.
What the figures mean
The discrepancy between the four watchTowr IDs and the three CVE IDs illustrates the complexity of the vendor’s response. According to the WatchTowr Labs report, PaperCut bundled separate vulnerabilities and their subsequent patch bypasses into singular CVE identifiers. This practice makes it difficult for security operations teams to determine exactly which flaws are addressed by specific updates or whether a patch fully resolves the underlying issues. The unauthenticated nature of the remote code execution chain means that attackers do not need valid credentials to exploit the system, significantly lowering the barrier for entry.
The report emphasizes that paper-based workflows and associated software remain prevalent in enterprise environments, keeping PaperCut MF a viable target. The chaining of vulnerabilities allows an attacker to progress from initial access to full remote code execution without triggering standard authentication checks. This pre-authentication capability is particularly dangerous for systems exposed to the internet or internal networks where lateral movement is possible. The specific bundling of bypasses into the same CVE as the original flaw suggests that initial patches may not have been sufficient to close the attack surface, requiring careful verification by IT administrators.
What to watch
Security teams monitoring this issue should track the specific watchTowr identifiers to understand the full scope of the attack chain. The use of three CVEs for four distinct problems means that standard vulnerability scanners may not accurately reflect the risk if they rely solely on CVE mappings. Organizations using PaperCut MF should verify which versions are affected by each specific watchTowr ID, as the vendor’s grouping strategy may obscure individual flaw details. The presence of patch bypasses indicates that the threat landscape for this software is dynamic, with potential for new exploitation techniques to emerge as defenders attempt to mitigate the initial chain.
Background: CVE identifiers
A CVE identifier is a unique string assigned to a publicly disclosed security vulnerability. It acts as a common name so vendors, tools, and researchers can discuss the same flaw without confusion. The ID itself carries no severity rating, timeline, or patch availability information.
Read the full guide: CVE Identifiers Explained: How Vulnerability Tracking Actually Works
What to do and how to stay safe: PaperCut MF
- Inventory all instances of PaperCut MF software within the network to determine exposure to unauthenticated remote code execution.
- Monitor vendor communications for clarifications on how the three CVEs map to the four identified vulnerabilities and their bypasses.
- Restrict network access to PaperCut MF services, ensuring they are not exposed to untrusted networks or the public internet.
- Review logs for signs of exploitation attempts targeting the specific endpoints associated with the disclosed watchTowr IDs.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did WatchTowr Labs find in PaperCut MF?
WatchTowr Labs identified four distinct vulnerabilities, labeled WT-2026-0141 through WT-2026-0144, which can be chained for unauthenticated remote code execution.
Why are there fewer CVE IDs than vulnerabilities?
PaperCut bundled the vulnerabilities and their patch bypasses into three CVE IDs (CVE-2026-82077, CVE-2026-82078, CVE-2026-81578), causing a mismatch in counts.
Do attackers need credentials to exploit these flaws?
No, the vulnerabilities form a pre-authentication chain, allowing remote code execution without valid user credentials or authentication.
