On this page
Atomicorp WAF Rule 398110
Rule Summary
- Rule ID: 398110
- Status: Active
- Alert message: Atomicorp.com WAF Rules: PaperCut NG/MF authentication bypass - privileged Tapestry component via public Home carrier (CVE-2026-81578)
- Observed CWEs: CWE-20 (1), CWE-22 (2), CWE-94 (4), CWE-287 (2), CWE-305 (1), CWE-346 (1), CWE-434 (2), CWE-470 (1), CWE-502 (2)
- Revision: 1
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Public tags: CVE-2026-81578, CVE-2026-82078, papercut
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “PaperCut NG/MF authentication bypass - privileged Tapestry component via public Home carrier (CVE-2026-81578)” in the request URI, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
CVEs Referenced by This Rule
The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.
CVE-2026-81578
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
- Association: The rule references CVE-2026-81578 in its alert message and tag.
- CVE Record (opens in a new tab)
- NVD (opens in a new tab)
CVE-2026-82078
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
- Association: The rule references CVE-2026-82078 in its tag.
- CVE Record (opens in a new tab)
- NVD (opens in a new tab)
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2012-0391 | Apache Struts Remote Command Execution | struts | 9.8 (v3.1) | Critical |
| CVE-2015-1635 | MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure | Windows 7 | 9.8 (v3.1) | Critical |
| CVE-2015-7450 | IBM WebSphere RCE Java Deserialization Vulnerability | sterling b2b integrator | 9.8 (v3.1) | Critical |
| CVE-2017-18365 | Github Enterprise Default Session Secret And Deserialization Vulnerability | github | 9.8 (v3.0) | Critical |
| CVE-2019-3396 | Atlassian Confluence Widget Connector Macro Velocity Template Injection | confluence server | 9.8 (v3.1) | Critical |
| CVE-2026-82078 | PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078) | papercut mf | 9.4 (v4.0) | Critical |
| CVE-2013-10047 | MiniWeb (Build 300) Arbitrary File Upload | MiniWeb | 9.3 (v4.0) | Critical |
| CVE-2020-11853 | Micro Focus Operations Bridge Manager Authenticated Remote Code Execution | operation bridge manager | 8.8 (v3.1) | High |
| CVE-2026-81578 | PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078) | papercut mf | 8.8 (v4.0) | High |
| CVE-2020-16952 | Microsoft SharePoint Server-Side Include and ViewState RCE | sharepoint enterprise server | 8.6 (v3.1) | High |
| CVE-2009-1122 | MS09-020 IIS6 WebDAV Unicode Authentication Bypass | internet information services | 7.5 (v2.0) | High |
| CVE-2009-1535 | MS09-020 IIS6 WebDAV Unicode Authentication Bypass | internet information services | 7.5 (v2.0) | High |
| CVE-2013-0156 | Ruby on Rails XML Processor YAML Deserialization Scanner | rails | 7.5 (v2.0) | High |
| CVE-2019-5418 | Ruby on Rails Path Traversal and Arbitrary File Read (CVE-2019-5418) | rails | 7.5 (v3.1) | High |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | 7.5 (v4.0) | High |
| CVE-2025-27218 | Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit | - | 5.3 (v3.1) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.