Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

watchTowr Labs dissects the messy patch saga that followed PaperCut's 27 August advisory about in-the-wild exploitation of version 26.0.3. Starting from bare IOCs with no CVE or patch, researchers independently rediscovered the exploited flaws, later confirmed as CVE-2026-82078 (post-auth RCE) and CVE-2026-81578 (auth bypass), then found that each successive PaperCut patch introduced a new bypass: WT-2026-0141, WT-2026-0142, and finally WT-2026-0143, an authentication bypass abusing Tapestry's Setup Wizard pages via the Home page that still worked against build 26.0.4-PO build 76508. Combined with a freshly discovered post-auth RCE in the Scan-to-Fax feature (WT-2026-0144, CVE-2026-82077, a path traversal in the fax connector binary path), the pair forms a complete unauthenticated remote code execution chain against that build. PaperCut has since shipped build 76530 and version 26.0.5 to close these gaps, and watchTowr released a Detection Artefact Generator to help admins check exposure.