PaperCut confirmed on August 27, 2026, that hackers are actively exploiting an unpatched vulnerability in its NG and MF print management software. Huntress said it has already observed the attack compromising two customer environments.
What to Know?
- PaperCut treats all NG and MF versions as potentially affected and has shipped emergency patches only for versions 25 and 26, with version 24 fixes still in progress.
- Security firm Huntress reproduced a full pre-authentication remote configuration takeover and remote code execution chain against a stock installation of PaperCut NG 25.0.11.75758.
- In The Register’s account, PaperCut says the emergency patch skipped its normal release process, so admins choosing to install it are running unvalidated software. No CVE identifier is published.
- Huntress recovered a payload that deletes the server’s server.log file and a /data/internal/derby.log file, along with its own Udydn.out output file.
How the Attack Chain Works?
A crafted request can point PaperCut’s authorization check at one page while the real component executed belongs to another. That mismatch lets an unauthenticated visitor alter server configuration, then execute arbitrary attacker controlled code inside the application process.
Huntress’s proof of concept triggered pre-authenticated code execution that spawned an observable process running as SYSTEM under the PaperCut Application Server. That is full host control, with no login required.
Attackers moved fast and stayed shallow in the incidents Huntress tracked. One intrusion lasted under two minutes and left base64-encoded “whoami & ver” commands profiling the account and OS. A second incident added “tasklist” to the same reconnaissance string, checking what else was running.
‼️ PaperCut zero-day is under active exploitation.
— The Hacker News (@TheHackersNews) August 28, 2026
The flaw affects all PaperCut NG and MF versions, with confirmed customer incidents. Emergency patches are available for v25 and v26. The exploit method and attackers remain unknown.
What PaperCut has disclosed so far:… pic.twitter.com/QMTTNFuK64
Reconnaissance, the opening move, not the objective. Neither the method of intrusion nor the flaw’s technical details have been disclosed by PaperCut in its advisory, an unusual level of silence for a company confirming active exploitation. The payload itself works to erase its own trail: on a compromised host running version 25.0.10.75465, Huntress recovered a Java class file that, after profiling the system, deletes its own output file along with the server’s server.log and a derby.log file.
That self-erasing design is why PaperCut’s own guidance reads as an engineering consequence of the malware, not routine hedging. Preserve logs and process trees before any patch or restart.
The Patch Is Its Own Risk Decision
PaperCut’s fix arrived outside its usual testing pipeline. We have not gone through our usual release process, the company said in an FAQ, describing the build as an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action.
That leaves administrators choosing between two imperfect options: run code that skipped normal validation, or pull the Application Server’s web interface off the public internet and restrict it to trusted IPs or a VPN, the option The Register expects most users to take.
Print management rarely draws the scrutiny of a mail server or VPN gateway, the same exposure pattern behind SMB Cybersecurity Data on organizations that leave management consoles reachable from the open internet.
SQ Magazine’s Takeaway
The mitigation is not complicated: take the Application Server interface off the public internet. What is harder is the choice PaperCut handed customers by shipping a patch outside its standard process. An unvalidated emergency build in a production print environment carries real risk, and PaperCut’s FAQ language acknowledges that trade-off rather than hiding it. That transparency helps administrators weigh the decision. It does not make the decision easy.
What’s Next: PaperCut says it will continue updating its advisory with additional indicators of compromise and remediation guidance as its investigation continues, and version 24 fixes remain outstanding. Organizations on unpatched builds, including remote and hybrid teams covered in Remote Work Security Data, should isolate the Application Server interface now, capture server logs and configuration before any restart, and watch for the specific errors PaperCut flagged.
