PaperCut NG/MF Zero-Day Under Attack: Pull the Web Interface Off the Internet Now

What Happened

On August 27, 2026, PaperCut Software published an urgent security bulletin warning that a vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. in its PaperCut NG and PaperCut MF print management products is being exploited in the wild. The vendor's statement is unusually direct: it is aware of confirmed customer incidents and is treating the matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility. as its highest priority.

The details that normally accompany an advisory are missing. There is no CVE identifier yet, no CVSS score, and no public description of the flaw or the exploitation chain. PaperCut says its security team reproduced the vulnerability using information supplied by a university customer, and that it will update the bulletin as verified facts become available, including indicators of compromise and remediation guidance.

What the company has said is enough to act on. The bulletin describes the issue as remotely exploitable, states that it affects PaperCut NG and MF, and tells every customer with an internet-reachable Application Server to restrict access to the web interfaces to trusted IP addresses immediately. Emergency patches have been released for customers who cannot apply that network restriction; Help Net Security reports those patches cover version 25 and earlier, while BleepingComputer describes the vulnerability as affecting all versions. Until PaperCut publishes a definitive version matrix, treat every deployment as affected.

Who Is Affected

PaperCut NG and MF sit in a lot of environments that do not think of themselves as high-risk: universities, school districts, hospitals, law firms, and managed print fleets run by MSPs. That is exactly why print servers are an attractive target and why the vendor's wording about a university customer is not a coincidence. Education is the product's largest install base.

The exposure that matters here is the Application Server's web interface. In the 2023 PaperCut campaign, Huntress documented the management interface listening on TCP port 9191 by default and counted roughly 1,800 servers directly reachable from the internet on Shodan. Any organization that exposed that interface for remote administration, mobile printing, or third-party integrations is in scope for this incident, and the fact that the port is customizable does not change the risk if it is reachable.

If your PaperCut server is only reachable from internal networks or through a VPN, you are in a better position, but not a safe one. "Remotely exploitable" does not mean "internet-only." An attacker who already holds a foothold on a workstation can reach the Application Server just as easily as an external scanner can.

Technical Analysis

With no vulnerability details, the useful analysis is about what the Application Server is and what compromise of it buys an attacker.

The Application Server runs as the `pc-app.exe` process on Windows. Huntress's 2023 research showed that child processes spawned under it execute with NT AUTHORITY\SYSTEM privileges, which means any code execution bug in the web layer is a direct path to full control of the host. That is what made CVE-2023-27350 (PO-1216, CVSS 9.8) so damaging: an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. reached the setup-completed page, attackers flipped the print-script sandbox settings, injected JavaScript into printer scripts, and used that to launch PowerShell that pulled down remote management tools, cryptominers, and ransomware payloads. Clop and LockBit affiliates both used it. The companion flaw, CVE-2023-27351 (PO-1219, CVSS 8.2), leaked user directory data including proximity card numbers.

Nothing published so far says the 2026 bug is the same class of flaw, and you should not assume it is. What the indicators PaperCut has shared do suggest is that the exploitation path touches the database layer. The vendor lists two `server.log` error strings as signals worth investigating:

• `ERROR No suitable driver found for jdbc:no:x`
• `ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST`

The first is a JDBC driver-resolution failure with a nonsensical connection string, the kind of artifact left behind when an attacker is feeding controlled input into a database connection path. The second is a failed card-ID lookup with a SQL `VALUES CAST` fragment where a card number should be, which reads like an injection attempt against the card lookup function. That is inference from the error text, not vendor confirmation; PaperCut has not described the flaw.

The other indicator is more alarming: PaperCut says missing, truncated, or deleted `server.log` files are a sign of compromise. Attackers who scrub the application log are covering tracks, which implies post-exploitation activity beyond a single request. Any suspicious activity originating from `pc-app.exe` in your EDR telemetry should also be treated as a hit. PaperCut is explicit that the absence of these indicators does not mean a server is clean.

Because the server runs with SYSTEM privileges and typically holds domain credentials for directory sync and print release, a compromised Application Server is a launch point for lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal. rather than an end in itself. The 2023 campaign proved that in production.

Immediate Actions

Do these in order, today.

1. **Inventory.** Find every PaperCut NG and MF Application Server, including ones run by an MSP on your behalf and lab or secondary-site instances that never made it into the CMDB. If you do not know whether the web interface is internet-reachable, check from outside.
2. **Restrict access.** PaperCut's first instruction is to use firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. rules or network access controls so the web interfaces cannot be reached from untrusted internet addresses. Allowlist the admin subnets and the specific systems that need to talk to the server, and block everything else at the edge and on the host. The guide on how to restrict a web admin interface to trusted IP addresses walks through the allowlisting patterns that work in practice, including the reverse-proxy and VPN-gated options.
3. **PatchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program..** Apply the emergency patch through PaperCut's support channels if you cannot restrict access, and apply it anyway once you have. Because the version coverage is still ambiguous in public reporting, confirm your build against PaperCut's bulletin rather than a news article.
4. **Hunt.** Search `server.log` for the two error strings above and verify the log files are intact and have not been truncated. Pull process-creation telemetry for children of `pc-app.exe`: PowerShell, cmd, or anything reaching out to the internet from that lineage is not normal. Our companion piece on hunting for compromise before the vendor publishes indicators covers how to do this without a curated IoC list.
5. **Assume breach if exposed.** If the interface was internet-reachable at any point in recent weeks and you cannot prove the logs are complete, treat the server as compromised. Rotate the service accountService Account🛡️A non-human operating system or application account under which a service runs. Its permissions define the blast radius of any exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. against that service, since attacker code executes with the service account's access to files, secrets, and the network. and any directory credentials the server holds, and review authentication logs for that account.

Long-Term Outlook

The 2023 PaperCut incident ended up on CISA's Known Exploited Vulnerabilities catalog and fueled a wave of ransomware intrusions in education. This one has the same ingredients: a SYSTEM-level service, a large install base with thin security staffing, and confirmed exploitation before a patch had wide distribution. Expect a CVE, a KEV listing, and public proof-of-concept code to follow in that order; the window between disclosure and mass scanning is measured in days.

The durable fix is architectural. Print management servers do not need to be on the internet, and mobile-print or guest-print features that seem to require it can almost always be fronted by an authenticating proxy or moved behind a VPN. The explainer on why print management servers are a high-value target lays out the reasons this software class keeps showing up in breach reports, and it makes the case for treating print infrastructure with the same exposure rules you apply to VPN concentrators and mail gateways. Our earlier coverage of incident response for ransomware and zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. vulnerabilities remains the right playbook if the hunt in step 4 turns up something.

Watch the PaperCut bulletin for the CVE assignment and version matrix. When the vendor publishes formal indicators, rerun the hunt.

Sources

• PaperCut, URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026): https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
• BleepingComputer, PaperCut warns of NG, MF flaw exploited in zero-day attacks: https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
• Help Net Security, Unknown PaperCut NG/MF vulnerability is under active attack: https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/
• Huntress, Critical Vulnerabilities in PaperCut Print Management Software (2023): https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
• PaperCut, URGENT MF/NG vulnerability bulletin PO-1216 and PO-1219 (2023): https://www.papercut.com/kb/Main/PO-1216-and-PO-1219/