Death By A Thousand PaperCuts: PaperCut Pre-Auth RCE Chain and Patch Bypasses

watchTowr Labs has published security research detailing critical vulnerabilities in PaperCut software. The research reveals a pre-authentication remote code execution chain and multiple patch bypasses. The vulnerabilities are tracked under identifiers WT-2026-0141-0144 and assigned CVE numbers CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578. This research demonstrates significant security flaws that could allow attackers to execute arbitrary code without authentication on affected PaperCut systems.