PaperCut NG/MF Zero-Day: Patch All Versions Now

PaperCut, the widely deployed print-management platform, is warning customers that two vulnerabilities in PaperCut NG and PaperCut MF are being actively exploited in zero-day attacks, and that the flaws affect all versions of both products. The company has released emergency, out-of-cycle patches and is urging every customer to apply them immediately — including an updated Release 2 patch that adds hardening beyond the first emergency build.

Print servers are a soft target that punches above its weight: they sit inside the network, run with high privileges, and are often forgotten in patch cycles. PaperCut’s software runs in enterprises, universities, and government agencies worldwide, and a previous round of PaperCut flaws in 2023 was weaponized by ransomware crews within days of disclosure. The active exploitation this time raises the same stakes.

The two vulnerabilities

PaperCut’s advisory covers two distinct bugs that can be chained or used independently.

The more severe is CVE-2026-82078, which stems from unsafe dynamic class loading in the database connection utilities of PaperCut MF and NG. In practical terms, the flaw lets an attacker cause the application to load and execute arbitrary Java bytecode — a path to full remote code execution on the server hosting the software.

The second, CVE-2026-81578, is an improper access control vulnerability in the web management interface of both products. It allows an unauthenticated remote attacker to modify certain system configurations. On its own that is serious; combined with the class-loading bug, an attacker can reach configuration surfaces they should never touch and steer the server toward executing their code.

The combination — an access-control gap that opens the door and a class-loading flaw that turns access into execution — is why PaperCut is treating this as a top-priority, patch-now event rather than a routine advisory.

Discovered through active abuse

Unlike many disclosures that begin with a researcher’s private report, this one surfaced because it was already being exploited. PaperCut says it was alerted to the issue by a university customer’s internal security and digital forensics teams, whose findings gave PaperCut engineers enough to reproduce the bug and confirm it was being abused in the wild. That sequence — customer incident first, vendor confirmation second — is the defining marker of a zero-day, and it means defenders are starting from behind: attackers had working exploitation before the patch existed.

PaperCut has not published full indicators of compromise, and the identity of the attackers and the precise exploitation method remain unclear as of the advisory. What is confirmed is that there are real customer incidents, not merely a theoretical proof of concept.

Emergency patches — install Release 2

PaperCut moved quickly. At 2:10 a.m. AEST on August 28, 2026, the company released emergency, out-of-cycle builds for both the v25 and v26 branches of NG and MF, covering Windows, Linux, and macOS installers.

Then it went a step further. After additional work with its internal security team and external researchers — including Huntress and watchTowr — PaperCut published an updated Emergency Patch (Release 2) that includes additional hardening beyond the original fix. The company’s guidance is explicit: all customers should install Release 2, even those who have already applied the first emergency patch. In other words, applying the initial build is not sufficient; the current recommended state is Release 2.

For teams that cannot patch instantly, the standard interim measures apply: restrict network access to the PaperCut Application Server, ensure the web management interface is not exposed to the internet, and lock down management traffic to known administrative hosts. These are containment steps, not fixes — the only remediation is the patch.

A familiar target profile

Print-management servers keep landing on exploited-vulnerability lists for structural reasons. They are typically deployed once and left running, integrated deep in the network with access to directory services and file shares, and rarely front-of-mind when security teams prioritize patching. That makes them an attractive foothold: quiet, privileged, and frequently unmonitored. The pattern echoes the steady stream of exploited enterprise-infrastructure flaws this year, from Oracle WebLogic to Citrix NetScaler — internet-adjacent management surfaces that attackers scan for the moment a patch reveals the bug.

The right mental model is zero trust: assume the print server is reachable by an attacker and design so that a compromise there does not hand over the rest of the network. Segmentation, least-privilege service accounts, and monitoring of the management interface all reduce what a foothold on the print server is worth — the same discipline that limits the blast radius of the mass-exploitation campaigns that have chained enterprise-software flaws into large-scale breaches. Building that assumption into the architecture is exactly what threat modeling is for.

What it means

This is an unambiguous, act-now situation for any organization running PaperCut NG or MF. Both products, all versions, are affected; exploitation is confirmed in the wild; and a patched build exists. The only question a defender needs to answer is how fast they can deploy Release 2 and, secondarily, whether they were already hit before they patched.

Who’s exposed: every PaperCut NG/MF operator that has not applied Release 2 — with internet-exposed management interfaces at the highest risk, and universities and other large, decentralized environments (where PaperCut is common and patch windows are slow) especially so. Who’s protected: organizations that patch to Release 2 promptly and that had already kept the management interface off the public internet.

What to watch next. First, whether CISA adds these CVEs to its Known Exploited Vulnerabilities catalog and sets a federal patch deadline, which would confirm the scope of exploitation. Second, whether ransomware groups adopt the exploit, as they did with PaperCut’s 2023 flaws — print servers with domain access are ideal ransomware launch points. And third, the eventual publication of indicators of compromise, which will let already-breached organizations detect the intrusion they may not yet know about. Until then, the instruction is simple: patch to Release 2, verify the management interface is not internet-facing, and hunt for signs of compromise on the assumption that you may already have been reached.