ET WEB_SPECIFIC_APPS PaperCut NG/MF Authentication Bypass via Apache Tapestry page/component Routing Confusion (CVE-2026-81578) M1

7.0.3 5.0SID: 2071859Rev: 1Enabled0 views

Fileemerging-web_specific_apps.rules

CreatedAugust 31, 2026

UpdatedAugust 31, 2026

Classificationweb-application-attack

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS PaperCut NG/MF Authentication Bypass via Apache Tapestry page/component Routing Confusion (CVE-2026-81578) M1"; flow:established,to_server; http.uri; content:"/app|3f|"; startswith; content:"service|3d|direct|2f|"; fast_pattern; pcre:"/^\d+\x2f(?:Error|Exception)\x2f/R"; http.method; content:"POST"; reference:url,rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/; reference:cve,2026-81578; classtype:web-application-attack; sid:2071859; rev:1; metadata:affected_product PaperCut_NG_MF, attack_target Server, tls_state TLSDecrypt, created_at 2026_08_31, cve CVE_2026_81578, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_08_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

References

url	rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
cve	2026-81578

Metadata

affected productPaperCut_NG_MF

attack targetServer

tls stateTLSDecrypt

created at2026_08_31

cve

CVE-2026-81578

deploymentInternal

confidenceHigh

signature severityMajor

tagExploit

updated at2026_08_31

mitre tactic idTA0001

mitre tactic nameInitial_Access

mitre technique idT1190

mitre technique nameExploit_Public_Facing_Application

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!