PaperCut Print Software: Zero-Days Under Active Attack

If your office uses PaperCut NG or PaperCut MF to manage printing, you need to know about two critical security flaws that are currently being used in real attacks.

PaperCut is a print management platform used by tens of thousands of organisations worldwide, including many UK businesses and schools. It runs in the background controlling who can print what, tracking usage, and managing print queues across the network. It is exactly the kind of quietly essential software that rarely gets a second glance from IT teams – which is part of why flaws in it are so valuable to attackers.

What has happened

On 27 August 2026, PaperCut disclosed two zero-day vulnerabilities affecting PaperCut NG and PaperCut MF. A zero-day is a flaw that was already being actively exploited before the vendor was even aware of it, meaning there was no patch available at the point attackers started using it.

The two CVEs (CVE is the standard identifier used to track specific security vulnerabilities) are:

• CVE-2026-82078 (CVSS 9.4 out of 10): A flaw in how PaperCut handles database connections. It allows an attacker to load and execute arbitrary Java code on the PaperCut server.
• CVE-2026-81578 (CVSS 8.8 out of 10): An access control flaw in the web management interface. It lets an unauthenticated attacker – someone with no username or password – modify system configuration settings remotely.

Used together, these two flaws can be chained to give an attacker full remote code execution on the PaperCut server without needing any credentials at all. PaperCut has confirmed they are aware of customer incidents where both flaws have been exploited in combination.

On 31 August 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalogue – a list reserved for flaws with confirmed, real-world exploitation. At SFIT we treat KEV additions as a clear and urgent signal to act.

Why it matters to your business

Print management software might not feel like a front-line security concern, but PaperCut servers are typically:

• Connected to your internal network with broad permissions
• Accessible from the internet on many standard configurations (for remote print submission or admin access)
• Running on a Windows server with access to file shares and other internal resources

A compromised PaperCut server gives an attacker a foothold inside your network. From there, attackers can move laterally to other systems, access sensitive file shares, steal data, and deploy ransomware. The stakes are not limited to printing.

The fact that exploitation requires no credentials whatsoever makes this particularly serious. Attackers do not need to trick anyone into clicking a phishing link or handing over a password – they can hit your PaperCut server directly if it is internet-facing.

What has been patched and what you need to check

PaperCut released emergency patches for versions 24, 25, and 26 of both NG and MF. However, it later emerged that the initial fix could be bypassed, so PaperCut released a second emergency patch to fully close the vulnerability. If you applied the first patch, you should verify that you are on the most recent release.

The recommended actions are:

1. Update immediately to the latest patched release of PaperCut NG or MF. Because releases have moved quickly with multiple rounds of patching, check the official PaperCut security advisory at papercut.com for the current confirmed fix version rather than relying on any version number stated elsewhere.
2. Restrict network access to the PaperCut Application Server. If the admin interface is reachable from the internet, restrict it to trusted IP addresses only as an additional layer of protection.
3. Review your logs for any signs of suspicious activity. PaperCut’s official documentation includes guidance on what indicators to look for if you suspect exploitation may already have occurred.

What we would advise

If SFIT manages your IT, we are already reviewing whether PaperCut is in use across your environment and will be in touch where action is needed. If you manage your own infrastructure and are unsure whether PaperCut is installed or whether it is up to date, now is the time to check.

Our managed IT services include proactive monitoring and patch management, so vulnerabilities like this are caught and addressed without you having to track them yourself. Our IT security services include reviewing your attack surface – looking beyond obvious entry points like email to the supporting infrastructure that attackers increasingly target.

If you believe you may have been affected, our guide to cyber incident response for UK businesses sets out the steps to take in the first 72 hours.

If you would like help reviewing your PaperCut installation or your broader IT security posture, get in touch or call 01452 701355 for a no-obligation chat.