PaperCut published an “URGENT Security Advisory” on August 27, 2026, confirming active exploitation of a zero-day vulnerability that affects every currently supported version of PaperCut NG and PaperCut MF — its print management platform used widely across education, government, and enterprise IT. Version number is not a mitigating factor here; if you run a supported NG/MF release with the application server reachable from the internet, you are exposed. PaperCut shipped emergency, out-of-cycle builds for both the v25 and v26 branches at 2:10 a.m. AEST on August 28, covering Windows, Linux, and macOS installers.

What happened

PaperCut’s own account is that it was alerted to the issue by a university customer’s internal security and digital-forensics team, who had already caught exploitation activity against their own PaperCut Application Server. PaperCut engineers used that customer’s findings to reproduce the bug internally and confirmed it was being actively abused in the wild — not a theoretical proof of concept, a live attack chain observed against a real deployment.

The company has not yet disclosed the technical root cause while its investigation continues, and as of publication no CVE identifier has been assigned. That is unusual for a vendor moving this fast: the decision to ship same-day emergency builds outside the normal patch cadence, rather than wait for a scheduled release, signals PaperCut considers this a serious, directly reachable remote exploitation path against internet-facing servers rather than a low-severity issue. PaperCut’s history here is relevant context — CVE-2023-27350, an unauthenticated RCE in the same product line, was mass-exploited by the Bl00dy ransomware gang and later linked to Clop and LockBit intrusions, largely through internet-exposed university and enterprise print servers. This is the same deployment pattern and the same customer sector reporting the new zero-day.

Impact

PaperCut NG/MF Application Servers are commonly deployed with the web management interface reachable from the internet, particularly at universities and large organizations that need self-service print release from unmanaged or BYOD endpoints. That is precisely the exposure pattern that turned CVE-2023-27350 into a ransomware initial-access vector in 2023, and it is the same population at risk now. Until PaperCut discloses the vulnerability class (authentication bypass, deserialization, path traversal, or RCE), assume worst case for any exposed server: attacker-controlled code execution or full administrative takeover of the print management server, which typically holds Active Directory service-account credentials, print job metadata, and — depending on integration — a foothold onto the broader Windows domain it authenticates against.

Mitigation — do this now

PaperCut’s guidance for administrators who cannot immediately patch is to restrict access to the PaperCut Application Server’s web interface to trusted IP addresses only — pull it off the open internet if at all possible. Concretely:

  • Patch immediately. Apply the emergency v25/v26 builds released August 28 for your platform (Windows, Linux, macOS). Do not wait for the next scheduled maintenance window.
  • Firewall the management interface. If the server must stay internet-reachable for any reason, restrict inbound access to known-good administrative IP ranges via firewall or ACL, not the application’s own access controls.
  • Hunt for prior compromise. If your PaperCut server has been internet-facing, review web server and application logs for anomalous requests predating today’s disclosure, unexpected service-account authentication, new local admin accounts, or unfamiliar scheduled tasks and services on the host.
  • Rotate credentials. Any service or domain account used by the PaperCut Application Server should be treated as potentially exposed until you’ve confirmed no prior exploitation — rotate its credentials after patching.
  • Watch for KEV/CVE follow-up. Expect CISA to add this to the Known Exploited Vulnerabilities catalog once a CVE is assigned, given the confirmed in-the-wild exploitation and the product’s exploitation history; federal agencies should be ready to treat it as an accelerated remediation item.

Sources