PaperCut has released emergency updates for its NG and MF print-management platforms after confirming that attackers are exploiting a newly discovered vulnerability in customer environments. The issue affects every supported version, so administrators cannot determine safety simply by checking whether they run a recent release. Internet-exposed Application Servers need immediate attention.

Customer investigation uncovered active attacks

The vendor said a university customer’s security and digital-forensics teams first reported the problem. Their evidence allowed PaperCut engineers to reproduce the weakness and establish that exploitation was already occurring. PaperCut has not yet assigned a CVE or disclosed the underlying technical mechanism, a sensible precaution while organizations are still racing to reduce exposure.

Although public details remain limited, the response indicates a credible and urgent threat to reachable servers. PaperCut produced out-of-cycle builds within hours of its initial warning and described confirmed customer incidents. That combination makes this more than a theoretical software defect: defenders should work on the assumption that scanning and exploitation may expand as awareness spreads.

Who is exposed and what to do now

All currently supported PaperCut NG and PaperCut MF versions are affected. The greatest immediate risk falls on Application Servers accessible from the public internet. PaperCut recommends restricting inbound access to trusted IP ranges through firewalls or equivalent controls, even when monitoring has not revealed suspicious behavior.

Emergency builds are available for the version 25 and version 26 branches on Windows, Linux and macOS. A version 24 build was still being prepared when the alert was published, and customers should move to the newest supported release wherever possible. Because these are emergency packages rather than routine feature updates, change teams should prioritize them outside normal maintenance cycles.

• Inventory PaperCut Application Servers and identify any internet-facing instances.
• Limit access to internal networks, approved management addresses or a tightly controlled VPN.
• Install the emergency build appropriate to the deployed branch and operating system.
• Preserve logs and endpoint telemetry before remediation so evidence is not lost.
• Escalate unexplained service changes or suspicious child processes for incident response.

Indicators warranting investigation

PaperCut has highlighted several clues that may accompany exploitation. Teams should investigate unusual activity launched by the pc-app.exe process, server logs that are missing or unexpectedly shortened, and database-related errors referencing an unsuitable JDBC driver or card-ID lookups. These artifacts are leads, not a definitive detection rule.

The absence of those signs does not establish that a system is clean. Attackers can alter logs, and different exploitation paths may leave different traces. Defenders should correlate PaperCut events with endpoint detection records, authentication logs, firewall data and outbound connections. Any exposed host showing anomalies should be isolated and examined before being returned to service.

Why print servers attract attackers

Print-management systems sit close to identity services, user documents and enterprise networks, making them useful entry points. PaperCut’s platform has also attracted serious abuse before. In 2023, attackers used the authentication-bypass flaw CVE-2023-27351, including in ransomware-related activity. That history raises the likelihood that criminal operators will quickly test newly exposed weaknesses.

Organizations should treat patching as one part of the response, not the entire response. Reducing public exposure, applying least privilege to service accounts, segmenting print infrastructure and monitoring administrative actions can limit the damage from future defects. Teams that find evidence of exploitation should rotate relevant credentials and examine connected systems for lateral movement.

Communication matters during the response. Infrastructure owners, security operations and help-desk teams should share a single inventory and record the time each control was applied. That makes it easier to distinguish expected maintenance effects from attacker-driven failures and ensures that temporarily isolated servers are not accidentally returned to public access before validation.

The immediate priority is clear: isolate reachable PaperCut servers, deploy the emergency build and conduct a focused compromise assessment. This report is based exclusively on the Cyber Security News coverage published on August 27, 2026.