TLDR Tech / Practical
PaperCut vulnerability chain allows unauthenticated code execution
watchTowr security analysts have documented a complete chain of unauthenticated remote code execution vulnerabilities affecting PaperCut print management software, specifically version 26.0.4-PO build 76508. This exploit links an authentication bypass flaw (WT-2026-0143) with a new post-authentication RCE vulnerability (CVE-2026-82077). The researchers explained that issues within an outdated Apache Tapestry framework and relative path traversal in the scan-to-fax feature facilitated these security breaches and subsequent command execution.
Read the full story