NewswatchTowr Labs09.10.2026

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper! It still exists. We have

CVE-2026-81579In WibuKey für Windows vor Version 6.
CVE-2026-82078PaperCut NG/MF — PaperCut NG/MF Unsafe Reflection Vulnerability
CVE-2023-27350Active Exploitation of Critical Vulnerability in PaperCut MF (Multifunction) and NG (Next Generation)
CVE-2023-27351PaperCut NG/MF — PaperCut NG/MF Improper Authentication Vulnerability
CVE-2026-82077In der Scan-to-Fax-Komponente von PaperCut NG und PaperCut MF existiert eine Schwachstelle zur Pfad-Traversierung, die es einem authentifizi...
CVE-2023-27351Diese Schwachstelle ermöglicht es Fernangreifern, die Authentifizierung in betroffenen Installationen von PaperCut NG 22.
CVE-2023-27350papercut_mf: unzureichende Zugriffskontrolle
CVE-2026-82077PaperCut NG/MF: Pfadüberschreitung (Path Traversal)
CVE-2023-27350PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)
CVE-2026-81578PaperCut MF/NG: Umgehung der Authentifizierung
CVE-2026-81578PaperCut NG/MF — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
CVE-2026-81579Wibu-systems-ag Wibukey: Rechteausweitung
CVE-2026-82078PaperCut MF/NG: unsichere Reflection
CVE-2023-27350PaperCut MF/NG — PaperCut MF/NG Improper Access Control Vulnerability

Affected vendors and products

Source: https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/

Linked advisories

Affected vendors and products