WatchTowr Labs Discloses PaperCut Pre-Auth RCE Chain and Patch Bypasses

WatchTowr Labs has disclosed a critical security research finding involving PaperCut software, revealing a chain of vulnerabilities that enables pre-authentication remote code execution. According to a report submitted to the r/netsec community, the researchers detailed how these flaws can be chained together to compromise systems without requiring user credentials.

The disclosure, titled "Death By A Thousand PaperCuts," outlines a specific attack vector that exploits multiple underlying weaknesses. The report identifies a sequence of vulnerabilities, specifically citing CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578. Crucially, the research demonstrates that existing patches, referenced by the identifier WT-2026-0141-0144, can be bypassed. This means that organizations which applied previous updates may still be exposed to the remote code execution risk described in the new findings.

Context and Background

The term "Death By A Thousand PaperCuts" in the report title suggests that the exploitation relies on a combination of smaller issues rather than a single catastrophic flaw. By chaining these specific CVEs, an attacker can achieve a level of access that typically requires authentication. The pre-authentication nature of the exploit is particularly significant, as it allows attackers to target the software from outside the trusted network perimeter.

According to the source material from r/netsec, the technical details were provided by WatchTowr Labs. The submission highlights the complexity of the bypass, indicating that the previous remediation efforts did not fully address the root causes of the vulnerability chain. The inclusion of specific CVE identifiers allows security teams to map the findings to their existing vulnerability management frameworks, although the bypass nature of the exploit complicates standard mitigation strategies.

Who Is Affected

Organizations utilizing PaperCut software are the primary targets of this vulnerability chain. Because the exploit allows for remote code execution without authentication, any instance of the software accessible to an attacker is at risk. The fact that the exploit bypasses patches associated with WT-2026-0141-0144 implies that users who have updated their systems in response to previous advisories may have a false sense of security.

The impact is severe given the pre-authentication aspect. Attackers do not need to steal credentials or perform social engineering to initiate the compromise. This lowers the barrier for entry for threat actors, including those with limited resources, who can leverage the published chain to gain control over the affected systems.

What should you do?

Security professionals should immediately verify their current PaperCut software versions against the vulnerabilities listed in the WatchTowr Labs report. Given that the research indicates existing patches can be bypassed, simply having applied previous updates is not a sufficient control. Organizations should monitor for official statements from PaperCut regarding a new patch that addresses the specific bypasses described in the WT-2026-0141-0144 reference.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: PaperCut

• Audit all PaperCut installations to confirm current version status and cross-reference with CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.
• Restrict network access to PaperCut services to trusted IP ranges only, reducing the attack surface for pre-authentication exploits.
• Monitor system logs and network traffic for unusual activity indicative of remote code execution attempts or unauthorized administrative actions.
• Wait for an official vendor update that explicitly addresses the patch bypasses described by WatchTowr Labs before assuming previous fixes are sufficient.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main finding in the WatchTowr Labs report?

The report details a pre-authentication remote code execution chain in PaperCut software that bypasses existing patches.

Which CVEs are involved in this vulnerability chain?

The chain involves CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.

Are existing patches effective against this exploit?

No, the research indicates that patches associated with WT-2026-0141-0144 can be bypassed.