Executive Summary
On August 27, 2026, PaperCut and cybersecurity firm Huntress published urgent advisories warning that critical vulnerabilities in PaperCut NG and MF print management solutions are being actively exploited in the wild. The vulnerability chain enables unauthenticated remote attackers to gain full administrative control over PaperCut's trusted configuration interface, leading directly to arbitrary Java code execution within the server process. PaperCut has issued emergency patch builds for versions 25 and 26 (builds 25.0.12.76497 and 26.0.4.78120), while patches for legacy version 24 remain under development. All organizations deploying PaperCut infrastructure are urged to remove public internet exposure immediately and deploy emergency updates.
Deep-Dive Technical Analysis
PaperCut NG and MF are enterprise print management platforms deployed extensively across education, healthcare, legal, and government sectors.
1. Vulnerability Mechanics: The exploit chain targets the application's unauthenticated web setup and initial configuration endpoints. By manipulating specific HTTP request headers and parameter sequences, remote attackers bypass authentication checks that normally guard administrative configuration wizards.
2. Configuration Overwrite & RCE: Once access is gained, the attacker submits modified configuration payloads that reconfigure PaperCut's internal script execution and print release handlers. By supplying malicious Java class definitions or serialized objects, the attacker achieves arbitrary code execution running with the elevated permissions of the PaperCut system service (frequently NT AUTHORITY\SYSTEM on Windows or root/papercut on Linux).
3. Lateral Movement & Persistence: In active campaigns observed by threat analysts, attackers leverage the compromised PaperCut instance as an initial access broker. They immediately drop interactive web shells, dump Active Directory domain credentials cached in the print server, and stage lateral movement tools across internal corporate subnets.
4. Affected Versions: All PaperCut NG and PaperCut MF installations across all operating system platforms are treated as vulnerable. Fixed emergency releases include PaperCut NG 25.0.12.76497, PaperCut MF 25.0.12.76496, and version 26 equivalent emergency builds.
Industry Impact & Recommendations
Because print management servers bridge network segments and frequently hold domain administrative service accounts, compromised print servers present immediate domain takeover risks.
* Immediate Patch Deployment: Upgrade all PaperCut NG and MF installations to emergency build 25.0.12.76497 / 25.0.12.76496 or the latest version 26 security update immediately.
* Isolate Print Management Ports: Block all inbound internet access to PaperCut management ports (default ports 9191 and 9192) at perimeter firewalls. Management consoles should strictly reside on isolated internal management VLANs accessible only via VPN and zero-trust network access (ZTNA).
* Audit Service Account Privileges: Ensure the PaperCut service runs under a dedicated, least-privileged service account rather than LocalSystem or a Domain Admin account.
* Review Server Logs for Indicators of Compromise (IoCs): Inspect PaperCut application access logs (server.log and service.log) for unauthorized calls to configuration endpoints, unexpected administrative creations, or child process spawning from pc-app.exe (such as cmd.exe, powershell.exe, or curl.exe).