PaperCut NG/MF RCE Chain (CVE-2026-81578 + CVE-2026-82078, CISA KEV) — Sandbox Flags Post-Exploit Two-Stage Dropper

On August 28, 2026, The Hacker News reported attackers actively exploiting a newly patched flaw chain in PaperCut NG and PaperCut MF — the print-management software that organizations deploy deep inside their networks — an attack wave the Australian vendor answered with a second emergency patch for versions 24, 25 and 26 carrying 'additional hardening', alongside published indicators of compromise. Huntress researchers John Hammond and Andrew Brandt analyzed the root cause: a specially crafted unauthenticated request can render one page in the response while executing a component owned by a different page, so PaperCut's authorization check trusts the rendered page and misses the permissions required by the component behind it — giving an unauthenticated attacker remote control over PaperCut's trusted configuration, which can be abused to execute arbitrary Java code inside the application's process. The chain combines CVE-2026-81578 (CVSS 8.8; improper access control in the web management interface — backend actions fire before access-validation checks complete) and CVE-2026-82078 (CVSS 9.4; unsafe dynamic class loading in the database connection utilities — database driver classes are instantiated from configurable driver names with no allowlist). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, 2026, Rapid7 shipped a Metasploit module (rapid7/metasploit-framework PR #21842), and the 2026-08-29 CISO Daily Digest flagged the pair as a high-impact lateral-movement vector for exactly this reason: print servers sit on internal networks. This demo safely reproduces the follow-up stage of such a compromise — the payload an attacker drops on a compromised host to keep the foothold: a two-stage dropper script in which stage 1 writes a second-stage script to /tmp and executes it, with the calculator opening as the only visible impact (no real malware, nothing destructive), plus a Windows .cmd companion and a clean control script whose attack sequence has been removed. MetaDefender Sandbox detonates the sample in isolation, observes the write-then-execute dropper behavior and its command line, and flags the implant before it ever runs on production print infrastructure (MITRE ATT&CK T1105 Ingress Tool Transfer).