--- title: PaperCut NG and MF under active zero-day exploitation,... description: PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,... canonical: https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PaperCut NG and MF under active zero-day exploitation, patches released | daily.dev og:description: PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,... og:url: https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b og:image: https://api.daily.dev/og/posts/PAIVXH34b.png og:image:alt: PaperCut NG and MF under active zero-day exploitation, patches released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PaperCut NG and MF under active zero-day exploitation, patches released **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 0 comments ## Summary PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software, with confirmed incidents already reported. Emergency patches are available for public-facing servers; those unable to patch immediately should restrict web interface access via firewall rules or take the server offline. Indicators of compromise include suspicious activity from pc-app.exe, tampered server.log files, and specific JDBC/database errors. Print management software running with elevated privileges makes it an attractive target, as shown by the 2023 CVE-2023-27350 exploitation by Clop, LockBit, Iranian state-backed groups, and Bl00dy. ## Content PaperCut has confirmed active exploitation of a critical zero-day affecting all versions of PaperCut NG and PaperCut MF, its widely deployed print management software. The company published an urgent advisory on August 27, 2026, and has since issued two rounds of emergency patches after researchers found ways to bypass the first fix. ## What the vulnerability does The attack chain exploits Apache Tapestry's 'complex direct' request format to bypass page-level authentication entirely — no credentials required. Once past that gate, attackers can invoke privileged `ConfigEditor` and `UserList` components to reconfigure the server's external database lookup settings. From there, they inject a malicious JDBC connection that chains Apache Derby's `foreignViews` feature, an H2 database trigger, and the Nashorn JavaScript engine to achieve remote code execution. The result: arbitrary Java code running at SYSTEM-level privileges on the target server. Two CVEs have been assigned: - **CVE-2026-81578** — authentication bypass (CVSS 8.8) - **CVE-2026-82078** — unsafe dynamic class loading enabling RCE (CVSS 9.4) Chained together, they let an unauthenticated attacker go from zero to full server compromise. ## What attackers are actually doing Huntress observed real-world exploitation in two customer environments. Attackers ran base64-encoded reconnaissance commands and dropped a malicious Java `.class` payload via an attacker-controlled SMB2 share. The payload profiled the system and then deleted itself to cover tracks. Huntress also independently reproduced the full pre-auth RCE chain against a stock PaperCut NG 25.0.11.75758 install, confirming SYSTEM-level code execution. PaperCut has confirmed customer incidents with real damage, though it hasn't disclosed attacker identity or post-exploitation behavior while the investigation is ongoing. ## Patch history: two rounds PaperCut released an initial emergency patch for versions 25 and 26 on August 28, 2026 at 02:10 AEST (builds 25.0.12.76497/76496). Researchers from Watchtowr and Huntress subsequently identified bypass techniques and a new authentication bypass flaw, prompting a second emergency patch (Emergency Patch Release 2) covering versions 24, 25, and 26 on Windows, Linux, and macOS. Customers on version 23 or earlier won't receive a patch — they need to upgrade. ## What to do now - **Patch immediately** to the latest Emergency Patch Release 2 build for your version - **Remove public internet exposure** of the PaperCut Application Server if at all possible - **Restrict web interface access** to trusted IP ranges via firewall rules - **Block outbound SMB traffic** from the PaperCut server to prevent payload delivery via SMB2 shares - **Preserve logs** — don't let forensic evidence get overwritten ## Indicators of compromise Watch for: - Suspicious process activity from `pc-app.exe` - Modified or missing `server.log` files - Specific JDBC and database error strings in logs (PaperCut's advisory lists these) ## Context: PaperCut has been here before This isn't the first time PaperCut has been mass-exploited. CVE-2023-27350, disclosed in 2023, was picked up by Clop and LockBit ransomware operators, Iranian state-backed threat groups, and the Bl00dy ransomware gang. PaperCut's broad enterprise deployment makes it a recurring target — which is exactly why leaving these servers internet-facing is a bad idea even when there's no active zero-day. ## Questions this post answers ### Is there an active zero-day being exploited in PaperCut NG and MF? Yes, PaperCut has confirmed active exploitation of a zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software, with confirmed incidents already reported. Emergency patches have been released for customers running public-facing servers, and technical details of the flaw have not been disclosed. _Security teams tracking print server exposure can follow PaperCut vulnerability coverage on daily.dev._ ### What should I do if I can't immediately patch my PaperCut server? Restrict web interface access to trusted IP addresses via firewall rules, or take the affected server offline entirely until a patch can be applied. Administrators should also monitor for indicators of compromise, including suspicious activity from the pc-app.exe process, modified or missing server.log files, and specific JDBC and database errors. _Ops teams weighing mitigation trade-offs during active exploits can find guidance on daily.dev._ ### Has PaperCut been targeted by ransomware groups before? Yes, in 2023 CVE-2023-27350 in PaperCut was exploited by Clop and LockBit ransomware operators, Iranian state-backed threat groups, and the Bl00dy ransomware gang. Print management software often runs with elevated privileges and broad network access, making it a repeated target for attackers seeking a foothold in enterprise networks. _Anyone assessing recurring risk in print management software can track patterns like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PaperCut NG and MF under active zero-day exploitation, patches released","url":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b"},"datePublished":"2026-08-28T06:01:10.606Z","dateModified":"2026-08-28T19:14:50.060Z","description":"PaperCut is alerting customers to an actively exploited zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1665cb4f32d4e85197c5e84f54d05591?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1665cb4f32d4e85197c5e84f54d05591?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"PaperCut NG and MF under active zero-day exploitation, patches released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/papercut-ng-and-mf-under-active-zero-day-exploitation-patches-released-paivxh34b#faq","mainEntity":[{"@type":"Question","name":"Is there an active zero-day being exploited in PaperCut NG and MF?","acceptedAnswer":{"@type":"Answer","text":"Yes, PaperCut has confirmed active exploitation of a zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software, with confirmed incidents already reported. Emergency patches have been released for customers running public-facing servers, and technical details of the flaw have not been disclosed. Security teams tracking print server exposure can follow PaperCut vulnerability coverage on daily.dev."}},{"@type":"Question","name":"What should I do if I can't immediately patch my PaperCut server?","acceptedAnswer":{"@type":"Answer","text":"Restrict web interface access to trusted IP addresses via firewall rules, or take the affected server offline entirely until a patch can be applied. Administrators should also monitor for indicators of compromise, including suspicious activity from the pc-app.exe process, modified or missing server.log files, and specific JDBC and database errors. Ops teams weighing mitigation trade-offs during active exploits can find guidance on daily.dev."}},{"@type":"Question","name":"Has PaperCut been targeted by ransomware groups before?","acceptedAnswer":{"@type":"Answer","text":"Yes, in 2023 CVE-2023-27350 in PaperCut was exploited by Clop and LockBit ransomware operators, Iranian state-backed threat groups, and the Bl00dy ransomware gang. Print management software often runs with elevated privileges and broad network access, making it a repeated target for attackers seeking a foothold in enterprise networks. Anyone assessing recurring risk in print management software can track patterns like this on daily.dev."}}]} ```