PaperCut has released a second emergency security update for two (2) actively exploited vulnerabilities in its NG and MF print management platforms after researchers discovered multiple ways to bypass the company’s initial fixes. The flaws, CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4), can be chained to achieve unauthenticated remote code execution (RCE). CVE-2026-81578 allows attackers to bypass authentication and modify critical server configuration settings, while CVE-2026-82078 abuses unsafe Java class loading/reflection to execute arbitrary bytecode under the security context of the PaperCut server process. Huntress and watchTowr reproduced the full pre-authentication RCE chain and identified several bypasses for the original emergency patch, leading PaperCut to issue Emergency Patch Release 2 with additional hardening. Huntress also observed exploitation in two (2) customer environments, where attackers used hex-encoded Java class files to execute operating-system commands and conduct reconnaissance, although malware deployment or persistence has not yet been observed. On August 31, 2026, The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal civilian agencies to remediate them by September 14, 2026, while ransomware involvement remains unknown. PaperCut is urging all customers (including those that already installed the first emergency patch) to deploy Release 2, available for versions 24 through 26, while users of version 23 or earlier should upgrade. Organizations should also restrict PaperCut management interfaces to trusted networks and review server logs, configuration changes, and unusual Java or PaperCut process activity for evidence of compromise. CTIX recommend any affected organizations ensure they follow the PaperCut and CISA guidance to prevent exploitation