As reported by SecurityAffairs, PaperCut Software has confirmed active exploitation of a zero-day vulnerability in its PaperCut NG and PaperCut MF print management products, with emergency patches released on August 28, 2026. No CVE identifier has been assigned yet, and technical details remain undisclosed. This is a developing incident with confirmed customer compromises.

Security Impact: As reported by SecurityAffairs, PaperCut Software has confirmed active exploitation of a zero-day vulnerability in its PaperCut NG and PaperCut MF print management products, with emergency patches released on August 28, 2026.

This marks yet another serious security event for PaperCut's product line. The company's print management software became a high-profile target in 2023 when CVE-2023-27350 and CVE-2023-27351 — both improper access control vulnerabilities enabling authentication bypass and remote code execution — were exploited by threat actors including Iran-linked APT groups. That PaperCut is again facing active zero-day exploitation suggests the product's architecture, deployment patterns, or both continue to present an attractive and reproducible attack surface.

Vulnerability Overview

ProductPaperCut NG, PaperCut MF (Application Server)
CVENot yet assigned
SeverityCritical (active exploitation, confirmed customer incidents)
CVSSNot yet published
Patch AvailableYes — emergency patches released August 28, 2026
Active ExploitationYes — confirmed customer incidents under investigation
Attack VectorNot disclosed; internet-exposed Application Servers are the primary target

Why This Matters

Print management infrastructure occupies a frequently neglected corner of enterprise security programs. These systems often run on legacy servers, receive inconsistent patching cadences, and are exposed to the internet for remote printer administration — creating a perfect storm of exposure, privilege, and neglect. PaperCut Application Servers frequently run with elevated privileges and integrate with Active Directory, making them ideal pivot points for lateral movement and credential harvesting once compromised.

The historical pattern is instructive. The 2023 CVE-2023-27350 exploitation campaign demonstrated that nation-state actors view print management as a viable initial access vector for espionage and data exfiltration. The current zero-day campaign, while attribution remains unclear, follows the same playbook: target internet-facing instances, exploit an access control weakness, and establish persistence before defenders notice.

Indicators of Compromise to Hunt For

PaperCut has released preliminary IoCs that security teams should immediately incorporate into detection workflows:
Why This Matters
Process activity: Suspicious behavior associated with pc-app.exe on PaperCut Application Servers, flagged by EDR or endpoint monitoring tools
Log tampering: Deletion, truncation, or modification of server.log files — a strong indicator of post-exploitation cleanup
Database error signatures: Look for these specific log entries indicating exploitation artifacts:
  • ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST Users
  • Network anomalies: Unexpected outbound connections from PaperCut servers, particularly to unfamiliar IP addresses or domains

    • Who Is at Risk

    Organizations most exposed include educational institutions, government agencies, and enterprises where PaperCut NG/MF Application Servers are internet-facing. Educational environments have historically been disproportionately targeted in PaperCut exploitation campaigns due to the combination of large deployments, constrained IT staffing, and perimeter-exposed infrastructure. Any organization running PaperCut NG/MF versions predating the August 28 emergency patch should consider itself at risk.

    Shield53 Recommendations — Immediate Actions

    1. Restrict network exposure NOW: If your PaperCut Application Server is accessible from the public internet, immediately limit web access to trusted internal IP addresses only using firewall rules, network access controls, or reverse proxy configurations. This is the single most critical mitigation.
    2. Apply emergency patches: Locate and deploy the patches released by PaperCut on August 28, 2026. Check the official PaperCut security bulletin for version-specific patch instructions.
    3. Conduct compromise assessment: Search all PaperCut server logs for the documented IoCs. Check for server.log tampering, unusual pc-app.exe behavior, and the specific database error strings. If any indicators are present, initiate incident response procedures immediately.
    4. Review authentication and session logs: Look for anomalous login patterns, unexpected administrative actions, or new account creation on PaperCut servers.
    5. Segment print infrastructure: Place PaperCut servers on isolated network segments with strict east-west traffic controls. Limit lateral movement paths to Active Directory and other critical services.
    6. Monitor for follow-on activity: Given the 2023 precedent of APT exploitation, monitor for credential dumping, data staging, and exfiltration behaviors that may follow initial compromise.

    Print management systems are infrastructure — not an afterthought. Every internet-exposed administrative interface is a potential front door for attackers. The fact that PaperCut is facing repeated zero-day exploitation underscores a systemic problem: organizations must inventory and harden all operational technology surfaces, not just the obvious ones.

    Shield53 will continue monitoring this developing situation. Expect a CVE assignment and additional technical details as PaperCut's investigation progresses. In the interim, network-level exposure reduction remains the most effective defensive posture.