As reported by BleepingComputer, two zero-day vulnerabilities in PaperCut NG and MF print management software—patched just days ago—are now being actively exploited for data theft in the wild. The speed from patch release to observed mass exploitation is remarkable, and the attack pattern signals a shift from initial access brokering toward direct data exfiltration.
Vulnerability Summary
| Field | Details |
|---|---|
| CVE Identifiers | CVE-2026-81578, CVE-2026-82078 |
| Affected Products | PaperCut NG, PaperCut MF (print management servers) |
| Vendor | PaperCut Software |
| Vulnerability Chain | Authentication bypass → Remote Code Execution |
| Exploitation Pattern | Auth bypass → External user-lookup hijack → Derby DB table dumps (data theft) |
| Patch Status | Patches released Aug 28–29, 2026 (two emergency patch sets) |
| Active Exploitation | Confirmed in the wild by Defused (honeypot activity since Aug 29, 2026 UTC) |
| Exposure Surface | 800+ PaperCut MF/NG servers internet-exposed (Shadowserver tracking) |
| Severity | Critical (chained auth bypass + RCE on widely deployed enterprise software) |
Why This Matters
PaperCut is not niche software. With 100 million users across 70,000 organizations—including state agencies, universities, and large enterprises—this is a sprawling attack surface that print management administrators rarely prioritize for security operations. The fact that threat actors pivoted immediately from zero-day exploitation to data theft, rather than using the access for ransomware staging, suggests a deliberate intelligence-gathering or data-broker operation.
The Derby database exfiltration technique is notable. Rather than deploying the RCE payload for persistence or lateral movement, attackers are abusing PaperCut's own user-lookup functionality to dump database tables—turning the application's legitimate features into a data-theft mechanism. This is harder to detect than traditional post-exploitation activity because the traffic originates from the application itself.
Historical Context Demands Urgency
PaperCut has been a recurring target since 2023. The CVE-2023-27350/27351 chain was abused by LockBit, Clop, Bl00dy ransomware, and Iranian APT groups (MuddyWater, APT35). CISA flagged another PaperCut RCE (CVE-2023-2533) as actively exploited in July 2025. This pattern tells us three things:
Who Is at Risk
- Education sector: Universities are heavy PaperCut deployers and historically slow to patch peripheral infrastructure.
- Government agencies: State and local governments with internet-exposed print servers are prime targets for both espionage and extortion.
- Healthcare organizations: Print servers in clinical environments often contain sensitive metadata about document workflows.
- Any organization with PaperCut NG/MF exposed to the internet—particularly those still running versions patched before Aug 28, 2026.
Shield53 Recommendations: Immediate Actions
1. Patch Now—No Exceptions
- Apply both emergency patch sets released Aug 28–29, 2026 to all PaperCut NG and MF instances.
- Verify patch installation across all instances, including secondary sites and forgotten test servers.
2. Remove Internet Exposure
- If PaperCut admin consoles or web interfaces are internet-facing, move them behind a VPN or zero-trust access layer immediately.
- Restrict the PaperCut Application Server port to internal networks only. External print submission should use authenticated relay paths, not direct exposure.
3. Hunt for Compromise
- Review PaperCut server logs for anomalous external user-lookup requests, especially bulk or scripted patterns.
- Check for unexpected Derby database access or large outbound data transfers from PaperCut hosts.
- Cross-reference against PaperCut's published IOCs.
- Inspect the Print Archiving feature for unauthorized document access—this was the pivot point in the 2023 campaigns.
4. Harden the Configuration
- Disable the Print Archiving feature if not strictly required—it has been a repeated attack enabler.
- Enforce strong admin credentials and MFA where supported.
- Implement network segmentation isolating print servers from domain controllers and sensitive data stores.
5. Monitor for Follow-On Activity
- Given the historical pattern, watch for ransomware staging indicators on any compromised PaperCut host: Cobalt Strike beacons, Mimikatz execution, volume shadow copy deletion.
- Deploy EDR coverage on all PaperCut servers if not already in place.
The window between patch availability and widespread exploitation has effectively closed. Organizations that have not yet patched should assume compromise and initiate incident response procedures alongside remediation. PaperCut's track record as a repeat target means this will not be the last advisory—treat print management infrastructure as Tier-1 critical assets going forward.
