The authorization check reads the wrong object. A crafted request can name one page to be rendered in the response and a different page that owns the component or action actually executed, and PaperCut's permission test lands on the rendered page rather than on the code behind it [3]. That is the unauthenticated foothold.
CVE-2026-81578, scored 8.8, is that gap in the web management interface: unauthenticated remote requests reach administrative functions and trigger backend actions before access validation completes [5]. CVE-2026-82078, scored 9.4, sits in the database connection utilities, where the application instantiates driver classes from configurable driver names with no allowlist check [4]. Change the configuration without a login, then have the server load the class you named [1]. Huntress puts the end state as remote control over the trusted configuration and arbitrary Java code running inside the application's process [2]. The higher score is on the class loading; the half of the chain that deletes the login requirement is the 8.8 [2].
The payload Huntress recovered is a Java .class file, operating-system agnostic, running under Linux or Windows to fingerprint the machine and produce a directory listing, written to a file named Udydn.out under a /data/content/ path relative to the install directory [10]. It then deletes Udydn.out, the server's server.log, and /data/internal/derby.log [11].
PaperCut has not said what the malicious activity looked like [13], so the detection material in circulation is Huntress's artifact set plus whatever the server configuration itself shows. The database driver name is a stored, attacker-writable value, which makes reading that field, and the rest of the config, part of the same day's work as the patch [1]. Recommended containment: remove public exposure immediately, apply the patch, and restrict Application Server web access to trusted IP addresses or place it behind a VPN or another controlled administrative path [14].
