As reported by The Hacker News, PaperCut has confirmed active in-the-wild exploitation of a zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF, with emergency patches released for versions 25 and 26. No CVE identifier has been publicly assigned at the time of writing, and technical details of the flaw remain undisclosed. What we do know is alarming enough: confirmed customer incidents, indicators of compromise pointing to post-exploitation activity, and log tamperingsuggesting adversaries are attempting to clean their tracks.

Security Impact: As reported by The Hacker News, PaperCut has confirmed active in-the-wild exploitation of a zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF, with emergency patches released for versions 25 and 26.

Why This Matters

This is not PaperCut's first rodeo. In 2023, CVE-2023-27350 (CVSS 9.8) was weaponized by Russian state-sponsored actors and the financially motivated group Lace Tempest to deliver Cl0p and LockBit ransomware. That vulnerability was trivially exploitable and went unpatched by many organizations for weeks. The current situation has the same structural ingredients: ubiquitous deployment in enterprise and education environments, servers frequently exposed to the internet for remote printing convenience, and a vendor whose product sits at the intersection of internal networks and user-facing services.

Print management software is consistently underestimated as attack surface. These servers handle authentication, hold service accounts with elevated directory permissions, and often run on legacy OS configurations. A compromise here is rarely contained to printing — it's a staging point for lateral movement, credential theft, and ransomware deployment.

Vulnerability Summary

FieldDetail
VendorPaperCut
ProductsPaperCut NG, PaperCut MF (all versions)
Patched Versionsv25 and v26 (emergency patch available)
CVEPending assignment
CVSSNot yet published
Active ExploitationYes — confirmed customer incidents
Threat Actors unidentified at this time

Indicators of Compromise

PaperCut has shared preliminary IOCs that defenders should immediately hunt for across their environments:
Vulnerability Summary
Intrusion detection, EDR, or network monitoring alerts involving the PaperCut Application Server, particularly suspicious child process activity originating from pc-app.exe
Missing, truncated, or deleted server.log files — a strong indicator of anti-forensics
Log entries matching: ERROR No suitable driver found for jdbc:no:x
Log entries matching: ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
The log tampering IOC is particularly significant. Adversaries who delete or truncate server logs are not opportunistic scanners — they are operators attempting to maintain persistence undetected. Treat any missing PaperCut log as a potential incident, not a configuration issue.

Who Is at Risk

The most exposed organizations are those running PaperCut Application Servers with web interfaces reachable from untrusted networks. This is common in:

  • Higher education institutions offering remote student printing
  • K-12 school districts with distributed campus environments
  • Enterprises with branch offices relying on centralized print management
  • Any deployment where PaperCut's admin console or user web interface is exposed without IP allowlisting

Organizations running older, unsupported versions of PaperCut NG or MF that are outside the v25/v26 patch window face the greatest risk — there may be no patch path available without an upgrade.

Immediate Actions

  • Restrict network access NOW: Implement firewall rules or network access controls to limit PaperCut server web interfaces to trusted IP addresses only. This is the single most effective mitigation until patching is complete.
  • Apply emergency patches: Upgrade to the latest patched release of v25 or v26 immediately. If you are on an older version, contact PaperCut support for guidance.
  • Hunt for IOCs: Search endpoint and SIEM telemetry for pc-app.exe spawning unexpected child processes (PowerShell, cmd.exe, certutil, rundll32). Check for missing or truncated server.log files. Search log archives for the two specific error strings listed above.
  • Review service account permissions: If compromise is suspected, immediately rotate credentials for any directory service accounts used by the PaperCut server, as these are prime targets for credential theft.
  • Enable enhanced logging: Ensure PaperCut server logs are being forwarded to a centralized SIEM with alerting on log deletion or truncation events.

Shield53 Recommendations

Beyond the immediate response, organizations should use this event as a catalyst to reassess how print management infrastructure is architected:

  • Segment print servers: PaperCut servers should never be internet-facing. Use VPN or zero-trust network access for remote users requiring print functionality.
  • Inventory and version management: Maintain an accurate asset inventory of all PaperCut deployments, including version numbers and patch status. You cannot defend what you have not enumerated.
  • Assume breach posture: Given the 2023 precedent and current active exploitation, treat any PaperCut server as potentially compromised until patched and verified clean. Conduct independent forensic review if IOCs are present — do not rely solely on log availability, as logs may have been tampered with.
  • Plan for the next one: PaperCut has now had two significant exploitation events in three years. Build patching runbooks specific to this vendor with pre-staged maintenance windows and rollback procedures.

This is a developing situation. Shield53 will provide updates as CVE details, CVSS scoring, and threat actor attribution become available. Given the ransomware nexus from the 2023 incident, defenders should assume worst-case scenarios and act with urgency rather than waiting for full technical disclosure.