As reported by BleepingComputer, PaperCut has disclosed active zero-day exploitation of a vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. Emergency patches have been released for public-facing Application Servers, and the company has published preliminary indicators of compromise. Notably, no CVE identifier has been assigned at the time of disclosure, and technical details of the flaw remain under wraps while PaperCut's security team continues its investigation.

Security Impact: As reported by BleepingComputer, PaperCut has disclosed active zero-day exploitation of a vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software.

Why This Matters

Print management software is a chronically under-defended segment of enterprise infrastructure. These systems sit at the intersection of identity, document handling, and network services — yet they are rarely treated with the same rigor as core business applications. PaperCut servers frequently manage print queues for entire campuses, hospitals, or government agencies, meaning a compromise can yield access to sensitive document flows, user directory information, and a foothold for lateral movement into trusted networks.

This incident also follows a well-established pattern. In April 2023, CVE-2023-27350 — a critical authentication bypass leading to remote code execution (CVSS 9.8) — was actively exploited in the wild against PaperCut servers. Threat actors, including ransomware affiliates, leveraged that flaw to compromise organizations that had delayed patching. The fact that PaperCut is again facing active exploitation suggests the product remains a high-value target for adversaries who recognize that print infrastructure is often internet-exposed and inconsistently monitored.

Vulnerability Overview

FieldDetail
ProductPaperCut NG, PaperCut MF (all versions)
CVE IDNot yet assigned at time of disclosure
SeverityUnrated — treat as Critical given active exploitation
Exploitation StatusActively exploited in the wild (confirmed customer incidents)
Patch AvailableYes — emergency patch released for public-facing servers
Primary MitigationRestrict web interface access to trusted IP addresses via firewall/NACL
Attack VectorNot disclosed — likely remote, targeting internet-exposed Application Server web interface

Indicators of Compromise

PaperCut has published preliminary IOCs. Defenders should hunt for the following:
Vulnerability Overview
Suspicious activity originating from the legitimate pc-app.exe process
server.log files that have been modified, deleted, or are missing entirely
Log entries matching: ERROR No suitable driver found for jdbc:no:x
Log entries matching: ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

PaperCut explicitly warns that the absence of these indicators does not confirm a clean bill of health. Attackers may have cleared logs or used techniques that don't generate the listed error signatures. Treat IOC absence as inconclusive, not as exoneration.

Who Is Most at Risk

  • Education institutions: Universities and K-12 districts are heavy PaperCut users and frequently expose print management interfaces for student convenience. The original report came from a university customer.
  • Healthcare organizations: Hospitals rely on print management for patient documentation workflows, and exposed servers can expose PHI.
  • Government agencies: Municipal and state offices running PaperCut for shared print infrastructure.
  • Any organization with internet-facing PaperCut Application Servers — this is the defining risk factor regardless of industry.

Shield53 Recommendations

Immediate Actions

  • Apply the emergency patch to all PaperCut NG and MF Application Servers, prioritizing internet-exposed instances. If patching is delayed, implement network-level restrictions immediately.
  • Restrict web interface access using firewall rules, network ACLs, or reverse proxy allow-listing to permit only trusted internal IP ranges. No PaperCut Application Server should be reachable from the public internet without a VPN or zero-trust access layer in front.
  • Conduct IOC hunting across all PaperCut server logs for the signatures listed above. Where logs are missing or truncated, assume potential compromise and escalate to incident response.
  • Review server.log integrity — compare current logs against backup snapshots if available. Missing or truncated logs are a red flag, not a convenience.
  • Isolate and investigate any server showing suspicious pc-app.exe activity. Capture memory and disk forensics before remediation if compromise is suspected.

Broader Hardening

  • Inventory all PaperCut deployments including version numbers, exposure status, and administrative contacts. Print infrastructure should be in your asset management system, not discovered during an incident.
  • Enforce network segmentation — PaperCut servers should reside in a restricted network zone with controlled egress, not flat corporate LAN space.
  • Implement log forwarding from PaperCut servers to your SIEM so that log deletion by an attacker doesn't eliminate the evidence trail.
  • Plan for the pattern: Given PaperCut's repeated targeting, establish a rapid response playbook specific to this vendor with pre-staged patching procedures and communication templates.

PaperCut has stated it will update its advisory with additional IOCs and remediation guidance. Security teams should monitor the official advisory page and treat this as an evolving incident. Given the 2023 precedent where delayed patching led to ransomware deployments, the window between disclosure and exploitation is narrow — act now, not after the next advisory update.