Cyber Threat Brief — August 30 2026
⚠️ This report is AI-generated. Always validate findings.
1. PaperCut NG/MF Pre-Auth RCE Zero-Day Chain — CVE-2026-82078 / CVE-2026-81578
TL;DR: Chaining an auth bypass in PaperCut’s web management interface (CVE-2026-81578, CVSS 8.8) with unsafe dynamic class loading (CVE-2026-82078, CVSS 9.4) gives unauthenticated RCE as SYSTEM. Actively exploited since Aug 26; first emergency patch was bypassed — apply Emergency Patch Release 2 immediately.
What’s New:
- Unauthenticated requests exploit a page-routing flaw where authorization checks trust the rendered page, not the backend action — lets attackers modify server configuration without credentials
- Attackers chain config takeover into
jdbc:derby:memory:pwndatabase driver loading to execute arbitrary Java bytecode viapc-app.exeas SYSTEM - Huntress confirmed exploitation in 2 customer environments starting Aug 26; observed base64-encoded recon (
whoami & ver & tasklist) and hex-encoded.classpayloads dropped toserver/lib/ - First emergency patch (Aug 27) was bypassed; Emergency Patch Release 2 shipped Aug 28 for versions 24, 25, and 26. No patch for v23 and older (47% of Huntress-tracked installs)
- Attacker cleanup: deletes
server.logand output files (Udydn.out) post-execution to destroy forensic evidence
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
jdbc:derby:memory:pwn in derby.log or server.log | Exploit artifact | T1190 | PaperCut data/internal/derby.log | High-confidence IOC — hunt for memory:*\pwn in derby boot entries |
.class files in server/lib/ (e.g., Udydn.class, Moo97.class) | Payload drop | T1059.004 | File integrity monitoring, EDR | Alert on new .class files under PaperCut server/lib/ |
.cmd/.out files in server/data/content/ | Recon output | T1082 | File integrity monitoring | Monitor for file creation in data/content/ with 5-char names |
pc-app.exe spawning cmd.exe, powershell.exe, or charmap.exe | Post-exploitation | T1059.001 | Sysmon (EventID 1), EDR | Alert on child processes of pc-app.exe that are shells or LOLBins |
Base64 d2hvYW1pICYgdmVy / d2hvYW1pICYgdmVyICYgdGFza2xpc3Q= in server.log | Recon commands | T1082 | PaperCut server.log | Grep server.log for known base64 recon strings |
ERROR No suitable driver found for jdbc:no:x in server.log | Exploit attempt | T1190 | PaperCut server.log | Indicator of exploitation attempt against DB config |
Missing or truncated server.log | Anti-forensics | T1070.004 | File monitoring, SIEM | Alert on server.log deletion or unexpected size reduction |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No PaperCut-specific detection; need pc-app.exe child process and derby.log IOC rules |
| Elastic | None | No PaperCut log parsing or exploitation detection |
| Sigma | None | No rules for PaperCut config takeover or Java class injection |
Sources: Huntress, BleepingComputer, PaperCut Advisory, The Hacker News
Status Updates
- CVE-2026-53362 (Linux Kernel IPv6): CISA KEV deadline TODAY August 30. Container escape via
__ip6_append_data()OOB write. Patch all containerized Linux workloads immediately. Original brief. - CVE-2023-49105 (ownCloud): CISA KEV deadline TODAY August 30. Pre-signed URL auth bypass weaponized by Chinese-speaking operators to steal Philippine nuclear research records. Original brief.
- CVE-2026-8452 (Citrix NetScaler): Federal deadline passed August 29. Web shells (
x.php,z.php) still being deployed at/var/vpn/theme/. Verify patch state with Bishop Fox’s SAML detection tool. Original brief. - CVE-2026-60004 (Gitea): Federal deadline passed August 28; 8,300+ instances still unpatched per Shadowserver. Cryptominer deployments ongoing. Original brief.